Privacy Policy

1. Who We Are

This notice covers workplace.aetas-wealth.com and its workplace consultancy, diagnostic and enquiry routes. Finch Theory Limited is the website operator and controller. Regulated financial advice provided through Aetas Wealth is handled separately by Insight Financial Associates Limited under its own privacy information and client agreement. HONED has its own notice at honedperformance.uk/legal/privacy.

2. Data We Collect

We only collect personal data that is necessary for the purposes described in this policy. We do not collect sensitive personal data (such as health, financial account, or identity documentation information) through our websites.

We do not collect payment card details, national insurance numbers, passport details, or any other sensitive financial or identity data through our websites.

3. Legal Basis for Processing

Under UK GDPR, we must have a lawful basis for processing personal data. The bases we rely on are:

• Legitimate interests, when you complete our diagnostic tool or make an enquiry, we process your data to respond to that enquiry and provide our service. We have assessed that our legitimate interest in doing so does not override your rights and freedoms.
• Consent, where we ask for your explicit agreement before using your data for a specific purpose, such as adding you to a mailing list.
• Contract, where processing is necessary to perform a contract with you, or to take steps at your request before entering into one.
• Legal obligation, where we are required to process data to comply with a legal or regulatory requirement, including our obligations under FCA rules.

Specialists listed in our expert directory

HONED publishes a directory of independent specialists. If you are listed in it, we hold and publish a limited amount of professional information about you: your name, your job title, the organisation you work through, and the specialist categories you are listed under.

We did not obtain this information from you. It was already published about you as a member of the Workplace Performance Platform or its predecessor, and we migrated it from that existing public directory. The information we publish is limited to the professional information described above that was already publicly available from that source, and we record the source location for each listing.

Our lawful basis is legitimate interests. Our interest is in preserving the continuity of an existing public directory so that employers can continue to find the specialists listed in it. We have assessed that this does not override your rights and freedoms.

We do not publish your direct contact details. These are withheld unless you have separately and explicitly given us permission to publish them.

We retain this professional directory information for as long as the specialist remains listed in the directory. We may remove or update it sooner where appropriate, including following the exercise of applicable data protection rights.

You can object to this processing at any time. As set out in Your rights below, where processing is based on our legitimate interests you can object, and we will cease processing unless we can demonstrate compelling grounds to continue. You may also ask us to correct or erase the information we publish about you, subject to any legal or regulatory obligations that require us to retain it.

To exercise any of these rights, contact us at matthew@finchtheory.com. We will respond within one calendar month.

If you are not satisfied with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113.

4. How We Use Your Data

We use personal data collected through our websites for the following purposes:

• To deliver the results of your organisational diagnostic and provide a personalised report
• To follow up on diagnostic submissions and discuss your results and potential next steps
• To respond to meeting requests, enquiries, and questions submitted through our websites or booking system
• To add you to our CRM system so we can manage our relationship with your organisation effectively
• To comply with our legal, regulatory, and professional obligations as an FCA-regulated business and its affiliated advisory firm
• To improve our services and communications over time, based on how organisations engage with our tools and content

We do not use your data for automated decision-making or profiling in a way that produces legal or similarly significant effects.

We will not use your email address to send unsolicited marketing communications. If we wish to add you to a newsletter or marketing list, we will ask for your consent separately and clearly.

5. Who We Share Your Data With

We do not sell, rent, or trade your personal data. We share data with the third-party processors listed below, and — where you ask us to put you in touch with a particular specialist — with that specialist's organisation. Both are explained in this section.

All third-party processors are required to handle your data in accordance with UK GDPR and to implement appropriate technical and organisational security measures.

Transfers outside the UK. HighLevel processes data in the United States. Those transfers are made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, and HighLevel states that it participates in the Data Privacy Framework, including the UK Extension.

Our enquiry and booking forms are hosted by HighLevel rather than on our own website. When one opens, your browser connects to HighLevel, and they may receive your IP address before you submit anything.

Enquiries you send to a specialist or partner

Our directory lists independent specialists who work for their own organisations. When you submit an enquiry for a specialist, provider or service, or register your interest in an event, you are asking us to put you in touch with that organisation, and we pass your enquiry to them so that they can respond to you. Our lawful basis is our legitimate interests in acting on a request you have deliberately made.

The organisation receives your name, your email address, your company name if you gave one, the content of your message, and the context of your enquiry — which specialist, service or event it relates to and which page you sent it from.

That organisation is an independent controller, not our processor. It receives your enquiry so that it can respond to you, and it is responsible for how it handles your information from that point onwards. Its own privacy notice applies to what it does with it.

We may also disclose data where required to do so by law, court order, or regulatory authority, including the FCA, where applicable.

6. How Long We Keep Your Data

We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by law or regulation.

• Diagnostic submissions, retained for up to 24 months from the date of submission, or until you request deletion
• CRM records, retained for the duration of our relationship with your organisation, and for up to six years thereafter to meet legal and regulatory record-keeping requirements
• Email enquiries, retained for up to 24 months unless the enquiry leads to an ongoing relationship, in which case our standard CRM retention applies
• Regulated financial services records, where Aetas Wealth provides regulated advice, retention follows Insight Financial Associates Limited’s applicable approved record schedule; ask the regulated provider for the period relevant to your service

When data is no longer needed, it is securely deleted or anonymised.

7. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access, you can request a copy of the personal data we hold about you
• Right to rectification, you can ask us to correct inaccurate or incomplete data
• Right to erasure, you can ask us to delete your personal data, subject to any legal or regulatory obligations that require us to retain it
• Right to restrict processing, you can ask us to pause our use of your data in certain circumstances
• Right to data portability, where processing is based on consent or contract, you can request your data in a structured, commonly used format
• Right to object, you can object to processing based on our legitimate interests, and we will cease processing unless we can demonstrate compelling grounds to continue
• Right to withdraw consent, where processing is based on your consent, you can withdraw it at any time without affecting the lawfulness of prior processing

If you are not satisfied with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

8. Cookies

We use necessary technologies to deliver and secure the site. Google Tag Manager loads optional Google Analytics 4 only after you accept. Declining loads no optional analytics. Use Cookie settings to change or withdraw your choice; withdrawal stops further collection and clears accessible analytics cookies, but cannot recall information already sent. Cookie identifiers and activity information may be personal data.

We aim to use only cookies that are strictly necessary or functional. If this changes, we will update this policy and introduce appropriate consent mechanisms.

9. FCA Regulation and Financial Data

Aetas Wealth is a trading style of Insight Financial Associates Limited, which is authorised and regulated by the Financial Conduct Authority (FCA registration number 458421). Where Aetas Wealth provides regulated financial advice or planning services, the handling of personal and financial data is subject to additional obligations under FCA rules, including applicable FCA rules and its own approved privacy and record-keeping arrangements.

Finch Theory Limited is not itself FCA-regulated but operates in close association with Insight Financial Associates Limited and adheres to the same data protection standards in its handling of personal information.

If you receive regulated financial advice through Aetas Wealth, a separate client agreement and data notice will be provided at that stage, setting out the specific basis on which your financial information will be processed.

10. Changes to This Policy

We review this privacy policy periodically and will update it when our practices change, when new services are introduced, or when required to do so by law or regulation. The date at the top of this page shows when the policy was last updated.

Where changes are material, we will take reasonable steps to bring them to your attention. Continued use of our websites following an update constitutes acceptance of the revised policy.

11. Contact Us

If you have any questions about this privacy policy, wish to exercise your data rights, or have a concern about how we have handled your personal information, please contact us:

If you are not satisfied with our response to a data concern, you have the right to complain directly to the ICO at ico.org.uk.