2plan Privacy Policy

Introduction

This privacy notice explains who we are, how we collect, share and use your personal information, and how we protect your data. It is intended to help you understand your privacy rights and how we comply with UK data protection laws.

Personal information is any information that can be used to identify you as a unique individual.

Who we are

This privacy notice is provided on behalf of 2plan Group Limited (“2plan”) and its subsidiaries, which includes 2plan wealth management Ltd (ICO Registration Reference: Z9770624), who can all act as data controllers of your personal information. Its principal place of business is 3rd Floor Bridgewater Place, Water Lane, Leeds, West Yorkshire, LS11 5BZ (ICO Registration Reference ZB876231).

2plan, along with several other financial service companies, is part of “The Openwork Partnership” family, a trading style of Openwork Limited (ICO Registration Reference Z8925674), with both 2plan and Openwork Limited (Openwork) being part of the Openwork Holdings Limited (“OHL”) group of companies (ICO Registration Reference Z8961113).

Scope of this privacy notice

This privacy notice covers:

2plan Group Limited, all of its partners, representatives and subsidiaries, and all other legacy legal entities by which the network was previously known, (together, "2plan")

Financial advisory services are delivered by 2plan’s network of financial advisers who are either a Registered Individual (RI) of 2plan, or part of our network of appointed representatives firms (AR).

2plan operates under a “Joint Controllership” relationship with our RIs and AR Firms, whereby we jointly determine the purposes and means of processing our clients’ personal data. 2plan also has access to personal information that 2plan’s AR firms collect and use via 2plan’s centralised IT systems (which is required to facilitate the AR’s services).

Within this joint controller arrangement, both 2plan and its AR firms share responsibility for complying with appropriate privacy and data protection laws and partner together to ensure we have the right measures in place, protecting our clients’ data and establishing a foundation of trust, to be maintained on an ongoing basis.

Throughout the remainder of this notice , "we", “us” and "our" shall refer to “2plan”, its RIs and its ARs in partnership as joint controllers.

Separate privacy policies exist for candidates and colleagues employed by 2plan and its AR firms and are made available to those individuals separately from this privacy notice.

How we collect your personal data

We will collect your personal data in the following ways:

  • Directly from you:
    • During fact finding meetings and any other meetings with you.
    • When you complete a form or survey or provide information on our website.
    • When you contact us by phone, in writing, by email -or electronic methods.
    • When you send us information as part of an on-going service delivery.
    • When you register to receive communications.
    • Provided by you as part of accessing 2plan services or attending 2plan events.
  • From Third Parties:

    Before you provide personal data about another individual, please ensure you have their consent.

    • When you are referred to us by an introducer or a professional service firm.
    • From policy providers, mortgage providers, or other financial institutions.
    • Via publicly available sources and online searches.
    • From other clients where it is necessary to do so e.g. where you are a beneficial owner of their assets or as an individual making payments to their account.
    • Information provided by legal firms in relation to legal proceedings.
    • Where information is passed to us as a result of us acquiring or merging with another firm or advice network; or an RI or AR joining our firm (of which you were previously a client).
  • Through Our Website
    • Using cookies and similar technologies (please see our separate Cookie Notice on our website).

The types of information we collect

  • Identity data includes your full name, title, date of birth, age, personal identifier and policy/account numbers.
  • Contact data includes your home address, email address and phone number.
  • Financial data includes your earnings, income, expenditure, bank account number, credit/debit card number, existing investments, pension and insurance products, spending habits, transaction history, tax reference number, source of wealth and source of funds.
  • Family data includes your marital status, next of kin, dependents and emergency contact details.
  • Profile data includes your sex, occupation, employment status, citizenship, residential and domicile status, property details, occupancy status and insurance information.
  • Identification data which includes your driving licence, passport, National Insurance number and other national identifiers.
  • Technical data includes internet protocol (IP) address, location data, operating system, time zone etc.

We also collect special categories of personal data which includes:

  • Health data which includes any physical disability, mental disability or any medical condition.
  • Criminal data which includes information about criminal convictions and offences, allegations. (proven or unproven) and investigations, penalties and restrictions, County Courts Judgements and insolvency details as well as information relating to the absence of convictions.
  • Special category data includes information about your health, racial or ethnic origin, sex life, sexual orientation.
  • Biometric data – includes a fingerprint, voiceprint, or scan of hand or face geometry, retina/iris scan.

It is important that the personal information we hold about you is accurate and up to date.

We do not and will not knowingly collect any personal data from any unsupervised child under 13. If you are under 13, you must not use our websites unless your parent or legal guardian has given explicit consent for your access.

Please keep us informed of any changes to your personal information, such as change of contact details.

How do we use your personal information?

Purpose/Activity Types of personal information Legal Basis
Provision of financial advice and ongoing servicing.
  1. Identity data
  2. Contact data
  3. Financial data
  4. Family data
  5. Identification data
  6. Profile data

Necessary for the performance of a contract
Provision of services relating to insurance products.
  1. Identity data
  2. Contact data
  3. Financial data
  4. Family data
  5. Identification data
  6. Profile data

Legal obligations and substantial public interest (relating to insurance)
Managing and administering the policies you hold through us.
  1. Identity data
  2. Contact data
  3. Financial data
  4. Family data
  5. Identification data
  6. Profile data
  7. Technical data

Necessary for the performance of a contract

Meeting our legal and regulatory obligations
  1. Identity data
  2. Contact data
  3. Financial data
  4. Family data
  5. Identification data
  6. Profile data

Legal obligations

Anti Money Laundering requirements.
  1. Identity data
  2. Contact data
  3. Financial data
  4. Family data
  5. Identification data
  6. Profile data

Legal obligation
Preventing and investigating fraud.
  1. Identity data
  2. Contact data
  3. Financial data
  4. Family data
  5. Identification data
  6. Profile data
  7. Technical data

Substantial public interest (preventing fraud)

Legal activities and advice.
  1. Identity data
  2. Contact data
  3. Financial data
  4. Family data
  5. Identification data
  6. Profile data

Legal obligation

Legitimate interest

Dealing with complaints and enquiries raised by you.
  1. Identity data
  2. Contact data
  3. Financial data
  4. Identification data
  5. Profile data

Legitimate interest

To send you marketing communications relating to our business, and other entities within 2plan and OHL, which we think may be of interest to you, by post or, where you have specifically agreed to this, by email or similar technology (you can inform us at any time if you no longer require marketing communications and/or you wish to withdraw your consent).
  1. Identity data
  2. Contact data

Individual consent. Provided by you as part of accessing 2plan services or attending 2plan events.

Handling data right requests, including when additional personal information is required to enable us to fulfil our obligations relating to the request.
  1. Identity data
  2. Contact data
  3. Financial data
  4. Identification data

Legal obligation

Handling data breaches involving personal data held on 2plan systems or on third party systems.
  1. Identity data
  2. Contact data
  3. Financial data
  4. Identification data
  5. Profile data
  6. Technical data

Legal obligation

Managing system administration, resolve website issues, enhance site quality, and personalise your experience. To track and address user problems, customise the website, enable service access, maintain security, and prevent fraud.
  1. Technical data
  2. Identity data
  3. Contact data

Consent provided by individual

Legitimate interest to ensure our systems are working effectively and user issues can be resolved.

Special Category Data

Purpose/Activity Types of personal information Legal Basis Additional Legal Basis
Anti Money Laundering requirements.
  1. Criminal data
  2. Biometric data

Legal obligation

Substantial public interest (suspicion of terrorist financing or money laundering)

Legal activities and advice.
  1. Health data

Legal obligation

Legitimate interest

Preventing and investigating fraud.
  1. Criminal data

Legal obligation

Substantial public interest (preventing fraud)

Provision of advice and services relating to insurance products.
  1. Health data
  2. Racial or ethnic origin data
  3. Health data
  4. Sex life data
  5. Sexual orientation data

Legal obligation

Substantial public interest (related to insurance)
To assess and accommodate our services to meet vulnerable customer needs.
  1. Health data

Explicit consent provided by the individual

Explicit consent

Automated decision making and profiling

Automated decision-making

In certain circumstances we may process your personal data through automated decision-making, including profiling, which involves computer based decisions without human involvement. This may include segmenting and tailoring the data to enable us to match our communication and products to your perceived needs. In the case we process your personal information through automated decision-making, we will inform you about the logic involved, as well as the significance and the envisaged consequences of such processing for you.

Profiling

There may be some circumstances where we use your personal information for profiling (processing of personal information to evaluate certain things about you). For example, to assess the quality of our service to clients. Where possible we will anonymise the data by excluding information (such as your name) that makes the data personally identifiable to you. We reserve the right to use such anonymous data for any purpose and disclose anonymous data to third parties, including but not limited to our research partners, at our sole discretion.

We’ll always make sure the way we process your information is safe and not unfair to you.

You have the right to object to us using your personal information for profiling activities. Please refer to the “Your Rights section for more information.

Marketing

We may use your personal information to provide you with information about our products or services which may be of interest to you, if you have provided your consent for us to do so.

If you wish to opt out of marketing, you may do so by clicking on the "unsubscribe" link that appears in all emails that are sent by your Partner or by telling us when we contact you. Otherwise, you can always contact us using the details set out in the section How to Contact Us to update your contact preferences.

Please note that, even if you opt out of receiving marketing messages, you may still receive communications from your Partner in connection with the products we offer you.

Third parties we share your personal data with

We may disclose your personal information to any of our employees, officers, insurers, professional advisers, agents, suppliers or subcontractors insofar as is reasonably necessary for the purposes set out in this privacy notice.

We may also share your data with third parties:

  • To perform services on your behalf
  • To the extent that we are required to do by law
  • In connection with any on-going or prospective legal proceedings
  • In order to establish, exercise or defend our legal rights (including providing information to others for the purpose of fraud prevention and reducing credit risk)
  • To any person who we reasonably believe may apply to a court or other competent authority for disclosure of that personal information where, in our reasonable opinion, such or authority would be reasonably likely to order disclosure of that personal information.

In certain circumstances, where there are internal teams providing shared services across 2plan and other entities within The Openwork Partnership, personal data of 2plan clients may be stored and accessed on Openwork systems (including the use of their systems to facilitate 2plan’s services). For certain processing activities required to provide 2plan’s services and other activities, data may be shared with other members of the Openwork Partnership who may be a processor, acting on 2plan’s behalf.

Types of third parties who may have access to your personal data include:

  • Professional service providers: when you have asked us to share your details with them.
  • Regulatory authorities, the government and tax authorities.
  • Fraud prevention and/or law enforcement agencies.
  • Product providers: The scope and extent of the sharing of information with product providers depends on the type of service you are receiving or requesting from us.
  • Purchasers/investors: We may share your information with third parties to whom we may choose to sell, transfer or merge parts of our business or our assets or who are stakeholders or investors in our business. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this notice.
  • Advertisers and data exchanges: We may share your information with advertisers (where we are permitted to do so) and data exchanges, so that we can offer you tailored content, including more relevant advertising for products and services which may be of interest to you. These third parties may set and access their own cookies, web beacons and similar tracking technologies on your device in order to deliver customised content and advertising to you when you visit 2plan websites.
  • Social Networks: Our websites and/or applications may also allow you to log in using a social network or other third-party account. Logging into one of our sites with your social network or other third-party account may allow us to gather information that you give us permission to access from that social network or third party.
  • Third Party IT System Suppliers who may host your data on their systems and may need some level of access to resolve technical concerns.

We will never sell or share your personal information with other organisations for their direct marketing purposes without your explicit consent. Except as provided for in this Notice, we will not provide your personal information to other third parties.

We require all third parties to respect the security of your personal data and to treat it in accordance with data protection laws. We do not allow our third party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

International transfers

We will only send personal data collected within the UK to foreign countries in limited circumstances such as to follow your instructions, to comply with a legal duty or to work with our suppliers, agents and advisers who we use to help run our business and services.

If we do transfer personal data outside of the UK, we will only do so to countries deemed by the UK to have adequate data protection laws or where we are satisfied that the personal data will be sufficiently protected in the destination country and through appropriate safeguards such as approved standard data protection contractual clauses.

Protecting your personal information

We are committed to protecting your personal information and implementing appropriate technical and organisational security measures to protect it against any accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access and against all other unlawful forms of processing.

We store all your personal data in highly secure software systems and when we share your personal data with third parties we do so in a safe and secure manner.

When collecting or transferring special category data we use a variety of additional security technologies and procedures to help protect this information.

How long do we keep your data for?

We keep your personal data for as long as it is required by us:

  • To the extent that we are required to do so by law.
  • If we believe that the information may be relevant to any on-going or prospective legal proceedings.
  • In order to establish, exercise or defend our legal rights (including providing information to others for the purposes of fraud prevention and reducing credit risk).
  • For the purposes set out in “How we use personal information” section.

Personal data that we process for any purpose will not be kept for longer than is necessary for that purpose. Notwithstanding the other provisions of this section, we will retain your personal data to support as specified above (with due consideration for the rights and freedoms of individuals’ privacy).

Different purposes will have different retention periods. When determining retention periods for personal data we take consideration of the following:

  • Legal and regulatory retentions periods.
  • The on-going operational needs of 2plan.
  • Our contractual rights and obligations.
  • Our IT system capabilities and any restraints.
  • Costs associated with maintaining, securing and retrieving data.
  • The types of advice clients have received and the products they hold.

If you would like further details on this, then please contact us directly by using the details in the “How to Contact Us” section.

Your rights

Under Data Protection Law, you have a number of rights relating to your personal data. The rights available to you depend on our reason for processing your information. You have the following rights which can be applied in certain circumstances:

  • The right to be informed about how and why your data is being collected and used.
  • The right of access to your personal data and receive a copy of it.
  • The right to rectification where you believe any of your data to be inaccurate or incomplete.
  • The right to erasure of your personal data (also known as the right to be forgotten).
  • The right to restrict processing of your personal data.
  • The right to data portability (e.g. transferring your data to a third party in in a structured, commonly used and machine readable format).
  • The right to object to processing of your personal data (including profiling) based on 2plan’s legitimate business interests, such as for direct marketing.
  • The right to withdraw your consent to data being processed about you (where processing is on the basis of your consent).
  • The right to object to decisions being taken solely by automated means, including profiling and request a human review in relation to any decision made solely through automated processing.
  • The right to make a complaint to the Information Commissioner’s Office about your data being processed.

To exercise any of these rights please email data.protection@2plan.com or click here.

Alternatively, you can get in touch using the details set out in the “How to Contact Us” section.

How to raise a concern

If you are unhappy about the use of your personal data, then please contact us directly and we will try our best to resolve your concern.

If, however, you believe that we have not been able to assist with your complaint or concern, you have the right to make a complaint to your local data protection authority the Information Commissioners Office.

How to contact us

If you have comments or any questions about our Privacy Policy or our Cookie Policy, please contact us by email at data.protection@2plan.com or by post:

The Data Protection Officer
2plan wealth management ltd
3rd floor Bridgewater Place
Water Lane
Leeds
LS11 5BZ

If you are engaging with 2plan via one of our AR firms, you can also contact your 2plan AR Firm directly using the contact details they have provided you (typically available to you on their headed paper or within the signatures of any email communication they send) if you would like any information about how they collect, store or use your personal information.

Changes to our Privacy Notice

From time to time we may need to make changes to this notice, for example, as the result of changes to law, technologies, other developments or new products and services being offered. We keep our privacy notice under regular review and we will place any updates on this web page. This privacy notice was last updated on March 2025.