Privacy Notice

We are committed to safeguarding the confidential information of our clients. We hold all personal information provided to our firm in the strictest confidence. These records include all personal information that we collect from you in connection with any of the services provided by us. The primary reason that we collect and maintain information about you is to more effectively administer our customer relationship with you whilst guarding against any real or perceived infringements of your rights of privacy.

Your personal data is data which by itself or with other data available to us can be used to identify you. MASECO LLP is a data controller and this statement sets out how we will use your personal data, the legal grounds for our use of your personal data and what your rights are in respect of the personal data which we hold, control and process, such as the right to move, copy or transfer your personal data (“data portability”). You can contact our Head of Compliance at The Kodak Building, 11 Keeley Street, London, WC2B 4BA if you have any questions.

MASECO LLP is a fully-owned business of a wholly-owned subsidiary of Creative Planning Holdco, LLC. Creative Planning, LLC (“Creative Planning”) is a subsidiary of Creative Planning Holdco, LLC.

Creative Planning and its affiliates provide investment management, financial planning and related services globally.

At present, MASECO LLP operates as a standalone entity with its own systems and infrastructure. We do not routinely share personal data with other Creative Planning group entities except where necessary to comply with legal or regulatory obligations, to support group-level oversight (including compliance, risk management and audit), or where you have requested or consented to such sharing.

Where personal data is shared within the Creative Planning group, the relevant entity will generally act as a separate and independent data controller unless otherwise notified.

This Privacy Notice is prepared in compliance with applicable data protection laws. For this purpose, ‘data protection laws’ means the UK General Data Protection Regulation and the Data Protection Act 2018, the Privacy and Electronic Communications Directive 2002/58/EC as amended by Directive 2009/136/EC, if you are in the United States of America the US Gramm-Leach-Bliley Act of 1999, if you are in California the California Consumer Privacy Act of 2020, the California Privacy Rights Act of 2020, and all national legislation implementing or supplementing the foregoing, all as amended, re-enacted and/or replaced or in force from time to time (collectively “Data Protection Legislation”).

The purpose of this Privacy Notice is to explain how we process your personal data (or personally identifiable information) in order to provide you with our services, how we collect your data, how we hold it securely and ensure that it is accurate, how you can gain access to the personal data we hold about you and the arrangements we have in place to ensure that we do not hold it for longer than is necessary.

This Privacy Notice is intended to be reasonably accessible, if you experience any difficulties accessing the information in the Privacy Notice, please contact the Head of Compliance.

1. Type of personal data we collect and use

Whether or not you become a client of ours, we will use the personal data you provide us with or which we obtain through other means (e.g. from social media) for the purposes set out below. If you become a client, we will use your personal data to provide you with the services with which we have agreed to provide you. Where we obtain personal data from sources other than you, this is mentioned in this statement.

The personal data we use includes:

your name and personal details including contact information (such as your primary and other residential address; your business address; your email address; business and personal mobile telephone numbers; your unique tax identifier, such as your National Insurance number or Social Security Number); your driving license and/or passport details;
your date of birth and/or age;
financial details, such as your salary and details of any other income and accounts held with other providers;
records of products and services you have held, how you have used them and the relevant technology used to access or manage them, including records of your and your authorised representatives’ access to and use of custody, trading, reporting and related services, activity logs, account and portal access history, session data, device and browser information, IP address, authentication data, and information about your interactions with connected applications, integrations and other digital services made available by us or by third party providers;
biometric data;
information from credit reference or fraud prevention agencies, electoral roll, court records of debt judgements and bankruptcies and other publicly available sources as well as information on any financial associates you may have, for example, through social and other media, such as LinkedIn;
family, lifestyle or social circumstances where relevant for the service with which we will provide you (such as the date of birth and/or age of any dependents (in order to assist us with financial planning));
education and employment details including employment status for credit and fraud prevention purposes and to assist us in understanding your level of knowledge and ability to understand the nature and associated risks of the services with which we may provide you; and
personal data about other named applicants, in which instances, you must have their authority to provide us with their personal data and you must provide them with a copy of this statement before providing us with any of their personal data and confirm to us the details of what you have agreed on their behalf.

2. Providing personal data

We will let you know if providing some personal data is optional including if we ask for your consent to process it. In all other cases, you need to provide your personal data otherwise this may affect our ability to provide you with our services.

3. Monitoring of communications

Subject to applicable data protection laws, we will monitor and record your telephone calls, emails, mobile application interactions and other communications in relation to your dealings with us. We will do this for regulatory compliance, self-regulatory best practices, crime prevention and detection, to protect the security of our communications systems and procedures, to check for obscene or profane content, for quality control and staff training and when we need to see a record of what has been said, for example, when investigating a complaint. We may also monitor activities on your account where necessary for these reasons and this is justified by our legitimate interests or our legal obligations.

We and third party custodians, platform providers and other service providers may also monitor, track, record and analyse your and your authorised representatives’ use of custody, trading, reporting and related services, including interactions with connected applications and integrations, for security, fraud prevention, troubleshooting, service administration, analytics, product and service improvement, regulatory compliance, audit and record-keeping purposes, where permitted by applicable law.

4. Using your personal data: Legal basis and purpose

We will process your personal data:

(a) as necessary to perform our contract with you for the relevant service, including:

to manage and perform that contract, including the selection of appropriate investments;
to update our records;
to trace your location to contact you about your portfolio and recover any outstanding payments;
to provide IT support;
to enable the analysis of data to automate workflows;
to facilitate secure communication and document sharing via our mobile application;
to enable custodians, platform providers and technology providers to operate, administer, support and troubleshoot custody, trading, reporting and related services and any connected applications or integrations used in connection with the services we provide to you;

(b) as necessary for our own legitimate interests or those of other persons or organisations or regulatory authorities, including:

for good governance, accounting, managing and auditing of our business operations;
to monitor emails, telephone calls and other communications and activities on your portfolio;
to allow us and third party custodians, platform providers and technology providers to monitor, track, record and analyse use of custody, trading, reporting and related services, including interactions with connected applications and integrations, in order to maintain security, prevent and detect fraud and misuse, investigate incidents, administer and improve services, develop and test systems and features, perform analytics, and support business continuity, risk management, audit and governance;
to send you marketing information about our services;
to operate and develop our business as part of the Creative Planning group, ensuring consistent standards and maintaining group wide security, risk management and governance frameworks

to ensure compliance with legal and regulatory requirements;
to establish and defend legal rights;
or activities relating to the prevention of crime;
to verify your identity and make credit, fraud prevention and anti-money laundering checks;
to monitor emails, telephone calls and other communications and activities on your portfolio.

(d) based on your consent:

where you request us to disclose your personal data to other people or organisations, such as your tax advisers or solicitors, or otherwise agree to disclosures;
where we process any sensitive personal data (such as your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, biometric data or data concerning your physical or mental health, gender orientation or sex life);
send you marketing communications where we have asked for your consent to do so.

5. Sharing your personal data

Subject to applicable data protection laws, we may share your personal data with:

other companies within the Creative Planning group for the purposes of group oversight, compliance, risk management, audit, reporting, and (where applicable) the provision of services to you;
other persons or companies who assist us in providing our services, such as the software suppliers of the risk modelling tool we ask clients to complete;
the manufacturers of the products in which we may invest your portfolio to the extent required by applicable law and regulation, for example, where the manufacturer demands confirmation that its product has been distributed by us to the target market identified by the manufacturer;
our legal and other professional advisers;
fraud prevention agencies, credit reference agencies both at the time we commence the provision of our services and periodically during the term of our appointment;
other organisations who use shared databases for identity and income verification;
government bodies and agencies in the UK and overseas (e.g. HM Revenue & Customs who may in turn share it with relevant overseas tax authorities and with regulators, such as the Financial Conduct Authority, the Securities & Exchange Commission in the US and the UK’s Information Commissioner’s Office);
courts in the UK and overseas, to comply with legal requirements, and for the administration of justice;
in an emergency situation or to otherwise protect your interests;
to protect the security or integrity of our business;
other parties connected with your portfolio e.g. power of attorney, and other people named on the Client Profile as having authority in relation to your portfolio, including joint account holders who will see your transactions;
if we restructure or sell the business or its assets or as part of any merger, acquisition, reorganisation or intra-group transfer involving Creative Planning;
market research organisations engaged by us to improve our services;
custodians, execution brokers, platform operators, software providers and other technology providers who support the provision of custody, trading, settlement, reporting, authentication, connectivity, analytics, security monitoring and related infrastructure or digital services, and who may process personal data, account data and service usage information for the purposes of operating, securing, supporting, administering and improving those services, complying with legal and regulatory obligations, and maintaining audit trails and business records;
technology vendors (including AI tool providers) to assist in delivering our services; and
anyone else where we have your consent or as required by applicable data protection laws.

We and any software provider whose services we use, may use sub-processors. Such sub-processors will only process data to the extent permitted by us and the software provider and will be subject to similar obligations such as having technical and organisational measures in place to prevent the unauthorised access to the data. The sub-processors may be located in countries outside the UK.

We will not disclose information to non-affiliated third parties except as required or permitted by law and as required for the purposes of establishing your relationship with us as set out above. If we were to anticipate a change in our policy, we would be required to notify you in advance of any such change taking effect.

Where third parties (including other Creative Planning group entities) process personal data on our behalf, they will do so as our processors and will be subject to contractual obligations to process personal data only in accordance with our instructions and applicable data protection laws. In other cases, third parties such as custodians, brokers, platform providers and certain professional advisers may process personal data as separate and independent controllers where they determine the purposes and means of processing for their own legal, regulatory, operational, security, service improvement or record-keeping purposes.

6. Third party access to your personal data

Subject to this Privacy Notice and to applicable data protection laws, we:

limit employee and agent access to information to only those who have a business or professional reason for knowing and only to non-affiliated parties as permitted by law;
maintain a secure office and computer environment to ensure that your personal data is not placed at unreasonable risk;
if an unaffiliated third party requires access to your personal data, such as administrators, consultants, auditors, lawyers, we also require strict confidentiality in our terms of engagement with them and expect them to keep this information private; and
do not provide your personal data to mailing list vendors or solicitors for any purpose.

Access to personal data via our mobile application is protected by secure authentication protocols. We recommend clients use device-level security features such as biometric authentication where available.

UK government and government agencies as well as US federal and state regulators also may review our records as permitted under law.

7. International transfers

Your personal data may be transferred outside the UK and the European Economic Area, including to the United States, where the Creative Planning group may be located. While some countries have adequate protections for personal data under applicable data protection laws, in other countries we will take the necessary steps to ensure appropriate safeguards apply. These include imposing contractual obligations of adequacy or requiring the recipient to subscribe or be certified with an ‘international framework’ of protection.

8. Identity verification and financial crime checks

The personal data we collect from you during the client onboarding process and thereafter will be shared with a third party to prevent financial crime, including money laundering. We may also search and use our internal records for these purposes.

9. Your marketing preferences

We will use your home address, telephone numbers, email address, mobile application notifications and social media (such as Facebook) to contact you according to your preferences. You can change your preferences or unsubscribe at any time by contacting us.

You may receive notifications or updates via the mobile application in accordance with your stated preferences. These can be managed within the app settings or by contacting us directly.

If you have previously told us that you do not want information on other services we provide or to be included in market research, we will continue to respect your wishes.

10. Data retention

We will retain your personal data for the duration of your time as a client of the firm and for 6 years after the date on which you cease to be a client or such other period of time as may be required by applicable legal or regulatory requirements, including UK and US securities laws. After this time, we will review the personal data we hold on record about you and determine whether we still have a legitimate interest in that data (for example, we are dealing with a complaint) or not. If not, we will arrange for the data to be destroyed or anonymised subject to any applicable legal or regulatory requirements which require us to continue to hold such data.

11. Data anonymisation and aggregation

Your personal data may be converted into statistical or aggregated data which cannot be used to identify you, then used to produce statistical research, reports and regulatory filings. This aggregated data may be shared and used in all the ways described in this notice.

12. Use of Artificial Intelligence (AI)

We may use Artificial Intelligence (AI) tools to support the delivery of our services. These tools assist with tasks such as document summarisation and processing, data analysis and client communications. AI is used to enhance efficiency, accuracy and service quality, but all outputs are reviewed and validated by our staff to ensure quality and reliability.

We remain fully accountable for decisions made using AI-assisted processes. All decisions with a financial impact (e.g., investment recommendations) are reviewed by qualified professionals in accordance with FCA and SEC regulations.

Where AI is used to process personal data, we do so in accordance with the UK GDPR and other applicable data protection laws. This includes conducting Data Protection Impact Assessments (DPIAs) where appropriate, and ensuring that any AI tools used are subject to robust governance and oversight.

We are committed to transparency in our use of AI. If you would like more information about how AI is used in relation to your data, or if you have concerns, please contact our Head of Compliance.

13. Visiting our offices

We have CCTV in operation at our offices. CCTV will capture images in real time wherever the cameras are pointed and these cameras will capture footage of you whilst you are on the premises.

We collect and process personal information via the CCTV system for the following purposes:

to ensure the health and safety of employees and visitors to our offices;
to detect, prevent or reduce the incidence of crime;
to prevent and respond effectively to all forms of possible harassment and disorder; and
to assist with employment issues, for example, discipline, where appropriate to do so.

We may be asked to provide footage to assist any law enforcement agency with any criminal damage or other investigation. We may also be asked for footage from insurance companies should there be an incident involving an accident on the premises. However, there is no planned regular or scheduled sharing of CCTV footage with any third party.

The CCTV system will keep footage for 30 days at which point it will be automatically overwritten by the system.

14. Your rights under applicable data protection laws

The Data Protection Legislation gives you the following rights as a ‘data subject:

the right to be informed about how we will process your personal data;
the right to have your personal data corrected if it is inaccurate and to have personal data completed;
the right to object to our processing of your personal data;
the right to restrict processing of your personal data;
the right to have your personal data deleted (known as the “right to be forgotten”);
the right to request access to your personal data and information about how we process it;
the right to move, copy or transfer your personal data (“data portability”); and
rights in relation to automated decision-making including profiling.

You also have the right to complain to the UK’s Information Commissioner’s Office. It has enforcement powers and can investigate compliance with data protection law. Its website is https://www.ico.org.uk.

For more details on all of the above you can contact our Head of Compliance at The Kodak Building, 11 Keeley Street, London, WC2B 4BA.