Data Protection and Your Rights

Life Bound Group is committed to respecting the privacy of individuals and protecting the personal information entrusted to us.

We believe individuals should understand what happens to their information, who receives it, why it is used and how they can exercise control over it.

This document explains our approach to data protection, including the safeguards and legal responsibilities relevant to our marketing and lead-generation activities.

It should be read alongside our Privacy Policy and Referral Disclosure, which provides further details about the personal information we collect, the purposes and lawful bases for processing, recipients, international transfers and retention.

Both documents apply to the personal information handled by Life Bound Group in connection with its business activities.

Business name: Life Bound Group

Legal entity: Life Bound Group Ltd, a private limited company registered in England and Wales (company number 17503977)

Business address: 66 Paul Street, London, EC2A 4NA, United Kingdom

Email: info@lifeboundgroup.co.uk

Life Bound Group is a UK marketing and lead-generation agency.

We provide advertising, enquiry-generation and introductory services to businesses, including FCA-authorised financial advisers.

Life Bound Group is not FCA-authorised, is not an appointed representative and does not provide regulated financial advice.

We do not make personal financial recommendations, assess the suitability of financial products or undertake regulated financial product arrangements.

Where we independently determine why and how personal information is processed, Life Bound Group acts as a data controller.

Where an adviser receives an agreed introduction and processes the information for its own advisory purposes, that adviser will normally act as a separate data controller.

Where we process information solely on another organisation's documented instructions, we may act as its data processor.

ICO registration: Life Bound Group Ltd maintains its applicable data protection fee registration with the Information Commissioner's Office, and its fee is up to date.

Our processing activities are subject to applicable UK data protection and privacy legislation, including:

• The UK General Data Protection Regulation (UK GDPR).
• The Data Protection Act 2018, as amended.
• The Privacy and Electronic Communications Regulations (PECR).
• Other applicable legal requirements governing the relevant processing activity.

Where relevant, additional laws may apply to international processing or activities involving individuals outside the United Kingdom.

Our approach is guided by the following data protection principles.

Lawfulness, fairness and transparency

Personal information must be processed lawfully, fairly and in a way individuals can understand.

Purpose limitation

Personal information must be collected for specified, explicit and legitimate purposes and must not be used incompatibly with those purposes.

Data minimisation

We must limit collection and use to information that is adequate, relevant and necessary for the relevant purpose.

Accuracy

We must take reasonable steps to ensure personal information is accurate and, where necessary, kept up to date.

Storage limitation

Personal information must not be retained in identifiable form for longer than necessary.

Integrity and confidentiality

Appropriate security measures must protect information against unauthorised or unlawful processing and accidental loss, destruction or damage.

Accountability

Life Bound Group must be able to demonstrate compliance with the data protection requirements that apply to its activities.

Life Bound Group collects prospective customer enquiries through advertising campaigns, online forms, marketing landing pages and direct communications.

We use GoHighLevel to collect, organise and manage leads.

Information collected may include a person's name, telephone number, email address, general location, service interests and relevant introductory responses.

We use this information to respond to enquiries, manage communications, carry out basic marketing qualification and facilitate requested introductions.

Where an individual agrees to an introduction, Life Bound Group shares relevant information with one identified financial adviser.

We do not automatically distribute the same lead to multiple unrelated advisers.

Both Life Bound Group and the receiving adviser may contact the individual about the enquiry, subject to the permissions and legal requirements applicable to each organisation.

Our introductory activities do not constitute regulated financial advice or a determination of financial suitability.

Life Bound Group uses separate consent checkboxes on its lead-generation forms.

Where consent is relied upon for sharing an enquiry with a financial adviser, the individual must receive clear information about the proposed disclosure and the intended recipient.

Valid consent must be freely given, specific, informed and indicated through a clear affirmative action.

We do not use pre-ticked consent boxes or treat acceptance of a privacy policy as permission for unrelated marketing.

We recognise that consent to an adviser introduction is separate from consent to optional marketing communications.

Where we rely on consent, appropriate records must be maintained so that the relevant choice can be demonstrated.

Individuals may withdraw consent at any time by contacting info@lifeboundgroup.co.uk.

Withdrawal does not affect processing that was lawful before withdrawal.

Where information has already been disclosed to an adviser acting as an independent controller, the individual may also need to contact that adviser about its subsequent processing.

Not every processing activity relies on consent.

Depending on the circumstances, Life Bound Group may rely on legitimate interests, contractual necessity, legal obligations or consent.

Examples include responding to requested enquiries, administering business relationships, managing introductory communications, maintaining necessary compliance records and facilitating an agreed adviser introduction.

Where we rely on legitimate interests, we must assess whether the processing is necessary and whether those interests are overridden by the individual's rights, freedoms and reasonable expectations.

Where consent is required under PECR or another applicable rule for a particular communication or technology, a separate UK GDPR lawful basis does not remove that requirement.

We do not regard an individual's submission of an enquiry form as blanket permission for all future marketing activities.

We recognise that introducing an individual to a financial adviser involves disclosing personal information to another organisation.

Before sharing information, there must be an appropriate lawful basis and the individual must receive the required privacy information.

Where we rely on consent, the intended adviser must be identified and the relevant permission obtained.

Information shared must be limited to what is appropriate for the agreed introduction.

The receiving adviser will normally be responsible for its own subsequent processing, including any regulated advice, client onboarding, additional information collection and marketing activities.

Each organisation must comply with its own data protection obligations.

Life Bound Group remains responsible for the lawfulness of its own collection, use and disclosure of personal information.

Our commercial relationships with advisers do not remove those responsibilities.

Life Bound Group uses technology providers to support its business operations.

These include GoHighLevel for lead management and may include other providers supporting website functionality, email, hosting and business administration.

Where a provider processes personal information on our behalf, the applicable legal requirements for processor arrangements must be satisfied.

These may include contractual provisions addressing processing instructions, confidentiality, security, subprocessors, assistance with individual rights, personal data breaches, deletion or return of information and appropriate audit rights.

We remain responsible for assessing whether our use of a service provider is appropriate for the information and processing involved.

Some technology providers may process personal information outside the United Kingdom.

GoHighLevel is operated by HighLevel, Inc., a United States-based business, and relevant processing may involve international transfers or access.

Where personal information is subject to a restricted international transfer, an appropriate legal transfer mechanism must apply.

Depending on the circumstances, this may include an applicable adequacy arrangement, a recognised contractual mechanism or another legally available safeguard.

Where required, appropriate transfer assessments and supplementary protections must also be implemented.

Individuals may contact info@lifeboundgroup.co.uk for information about the applicable international transfer arrangements and safeguards.

We do not treat consent to an adviser introduction as general authorisation for unrestricted international transfers.

Life Bound Group recognises its responsibility to protect personal information against unauthorised access, accidental loss, inappropriate disclosure and unlawful processing.

Security measures must reflect the sensitivity of the information, the processing activity and the associated risks.

Appropriate measures may include controlled access to systems, secure account management, confidentiality arrangements, staff awareness, service-provider oversight and incident-response procedures.

Access to personal information should be limited to individuals who need it for legitimate business purposes.

Personal information should not be disclosed to unauthorised individuals or used for purposes unrelated to the original collection without a lawful basis.

No electronic system can be guaranteed to be completely secure.

We must assess security risks and review relevant controls when circumstances change.

A personal data breach may involve the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal information.

Where a suspected breach occurs, it must be assessed promptly.

The assessment should consider the nature of the information, the circumstances of the incident, the likely risks to individuals and the steps needed to contain and address the issue.

Where a breach is notifiable under the UK GDPR, the ICO must be informed without undue delay and, where feasible, within 72 hours of becoming aware of it.

Where a breach is likely to result in a high risk to individuals' rights and freedoms, affected individuals must also be informed without undue delay unless a lawful exception applies.

Relevant incidents and decisions must be documented in accordance with applicable requirements.

Life Bound Group must retain personal information only for as long as necessary for the purpose for which it was collected, subject to applicable legal obligations and justified retention requirements.

Retention decisions must distinguish between active enquiries, inactive leads, completed introductions, consent evidence, business records and marketing suppression information.

Information that is no longer necessary must be securely deleted or anonymised unless there is a lawful reason to retain it.

Withdrawal of consent or a request for deletion must be assessed in accordance with the relevant legal requirements.

Some information may need to be retained to comply with legal obligations, address disputes or maintain proportionate evidence of compliance.

Minimal suppression information may be retained where necessary to ensure that a person's objection to direct marketing is respected.

Further information about retention is provided in our Privacy Policy and Referral Disclosure.

Individuals have the right to receive clear information about the collection and use of their personal data.

We provide privacy information explaining relevant purposes, lawful bases, recipients, rights, international transfers and retention arrangements.

Where information is collected directly, the required privacy information must be provided at the appropriate point of collection.

Where information is obtained indirectly, applicable transparency requirements and deadlines must be observed, subject to lawful exceptions.

We recognise that a privacy notice must reflect actual processing practices rather than simply describe legal principles.

You may ask Life Bound Group whether we hold or process personal information about you.

You may also request access to relevant personal information and supplementary information required by law.

This is commonly known as a subject access request.

You do not need to use a particular form or refer specifically to the UK GDPR.

Requests may be submitted by emailing info@lifeboundgroup.co.uk.

We may request proportionate information to verify your identity before disclosing personal information.

We will respond within the applicable statutory timeframe, generally one month, subject to any lawful extension or other applicable procedural rule.

You may request correction of inaccurate personal information.

You may also request that incomplete information be completed where appropriate.

Where a correction request is valid, we must take the necessary steps in accordance with applicable data protection law.

Where information has been shared with another controller, relevant notification obligations must be considered.

You may request deletion of personal information in circumstances where the right to erasure applies.

Examples may include information that is no longer necessary for its original purpose, processing based on consent that has been withdrawn where no other lawful basis applies, or processing that is unlawful.

The right to erasure is not absolute.

We may need to retain information where a lawful exception applies, including compliance with legal obligations or the establishment, exercise or defence of legal claims.

We will assess deletion requests individually and explain our decision where required.

You may request that Life Bound Group restrict processing in certain circumstances.

For example, restriction may be appropriate while the accuracy of information is being checked or while a relevant objection is being assessed.

Where processing is restricted, we must comply with the applicable legal limitations and safeguards.

You may object to certain processing based on legitimate interests.

Where an objection is made, we must assess it in accordance with applicable law and stop the relevant processing unless a lawful basis for continuing applies.

You have an absolute right to object to the processing of your personal information for direct marketing purposes, including related profiling.

Where you object to direct marketing, we must stop processing your information for that purpose.

You can submit an objection by contacting info@lifeboundgroup.co.uk.

Where the legal conditions apply, you may request eligible personal information in a structured, commonly used and machine-readable format.

You may also request transmission to another controller where technically feasible and legally required.

This right generally applies to information you have provided to a controller where processing is based on consent or contract and is carried out by automated means.

Not all information held by Life Bound Group will necessarily fall within this right.

Life Bound Group may review introductory information to determine whether an enquiry meets general marketing or referral criteria.

This is distinct from regulated financial advice or a financial suitability assessment.

Where profiling or automated processing is used, applicable transparency and data protection obligations must be satisfied.

Where solely automated decisions produce legal or similarly significant effects, the relevant legal conditions and individual safeguards must be observed.

Individuals may exercise any rights applicable to such decisions.

We distinguish between communications concerning a requested enquiry and optional direct marketing.

Submitting an enquiry does not automatically authorise unrelated marketing communications.

Where consent is required for marketing emails, text messages, automated calls or other communications, the necessary permission must be obtained.

Where another lawful route is available, its conditions must be satisfied.

Applicable rules may also require telephone marketing screening and compliance with objections or preference services.

Additional restrictions may apply to particular financial services marketing activities, including pension-related marketing.

Individuals may withdraw consent or object to direct marketing at any time by emailing info@lifeboundgroup.co.uk.

Limited suppression information may be retained where necessary to prevent unwanted marketing from restarting.

Life Bound Group does not currently use advertising tracking pixels on its marketing landing pages.

Essential technologies may be used where necessary for website functionality, security and enquiry forms.

Where non-essential cookies or similar technologies are used, clear information and legally required consent must be provided.

Any future introduction of advertising pixels, analytics or other non-essential tracking must be assessed against applicable data protection and electronic communications requirements before use.

Life Bound Group recognises that data protection compliance requires appropriate operational practices as well as written privacy documents.

Relevant obligations may include maintaining suitable processing records, assessing lawful bases, managing service-provider arrangements, maintaining appropriate security, handling individual rights requests and responding to personal data incidents.

Where processing is likely to result in a high risk to individuals, a data protection impact assessment may be required before the processing begins.

Our data protection arrangements must be reviewed where necessary to reflect changes in processing activities, systems, service providers, risks or applicable law.

If you have concerns about the handling of your personal information, please contact:

Life Bound Group

Email: info@lifeboundgroup.co.uk

You also have the right to complain to the Information Commissioner's Office.

ICO website: https://ico.org.uk/make-a-complaint/

You do not need to complain to Life Bound Group before contacting the ICO.

Where EU GDPR applies, you may also have the right to complain to an appropriate EU supervisory authority.

Complaints about regulated financial advice provided by a separate financial adviser should be directed to the relevant adviser through its own complaints procedure.

This does not restrict your rights concerning Life Bound Group's own activities.

This document provides additional information about Life Bound Group's approach to data protection and the rights available to individuals.

It should be read alongside our Privacy Policy and Referral Disclosure.

The Privacy Policy explains the specific personal information we collect, why we process it, the lawful bases we rely upon, the recipients of information and relevant retention and international transfer arrangements.

This document does not replace the Privacy Policy or any campaign-specific information that must be provided when personal information is collected.

We may update this document to reflect changes in our business operations, processing activities or applicable legal requirements.

Where required, individuals will be informed of material changes and additional consent will be obtained before new processing activities that require it.

The current version will be made available through our website together with its last-updated date.

Life Bound Group Ltd, 66 Paul Street, London, EC2A 4NA, United Kingdom

Email: info@lifeboundgroup.co.uk

Data protection: Applicable ICO data protection fee up to date.

Regulatory status: Life Bound Group is not FCA-authorised and does not provide regulated financial advice.

For enquiries concerning personal information, consent withdrawal, marketing objections or data protection rights, please contact info@lifeboundgroup.co.uk.