Privacy notice

How I handle your information

Salworth is a management consultancy for financial services. My work can involve personal, financial and health information, including when I work hands-on for a firm and handle its customers' information on its behalf. This notice explains what I handle, why, and how I protect it. I use it only for the reasons below, and I never sell it.

Last updated: 3 November 2026

1. Who I am

Salworth Limited is both a controller and a processor:

Controller of its own business information, such as enquiries, business contacts, client firm staff details, contracts and invoices.
Processor of a client firm's customer information when I work for that firm. The firm is the controller of its customers' information and decides how it is used. See the box in section 2.

Salworth Limited is registered in England and Wales, company no. 17483028. Registered office: 1 Cotswold Croft, Halesowen, B63 1JL. Registered with the Information Commissioner's Office, registration no. ZC262194 (view it on the ICO public register).

For any privacy question, contact Steve Salmond, Director: steve@salworth.co.uk.

2. What this notice covers

People who visit this website.
People who contact me, or whom I meet at events or through introductions.
People at the firms I work with: principals, advisers and staff.
Customers of the firms I work with, as explained in the box below.

Customers of the firms I work with. Some engagements are hands-on: I work inside a client firm's team, which can include speaking with its customers and working on their cases. When I do, I handle customer information only on that firm's instructions, under the data protection terms in our written agreement. The firm is the controller and its own privacy notice applies, so please contact the firm about your information. You can also contact me and I'll pass your request on the same working day.

While working for a firm I:

use the firm's own systems, email and phone lines, and keep its customer information on them;
don't keep copies of customer information on Salworth's own systems or devices;
see only what the work needs, which can include sensitive details such as health information where the firm's work requires it;
never use customer information for Salworth's own purposes or marketing;
never put customer information into any software or AI tool unless the firm has approved it in writing;
tell the firm the same working day if anything goes wrong with its information, if you raise a concern or complaint, or if I think you may need extra care or support;
return or delete anything I hold for the firm when the work ends.

3. What I collect and why

Who	What	Why, and the lawful basis
Customers of client firms (when I work hands-on inside a firm)	What the firm's work needs, which can include: name, contact details, date of birth, address history, proof of identity, employment, income and outgoings, credit history, property and mortgage details, existing policies and, for protection cases (life, critical illness and income protection), health and lifestyle information, including medical evidence and insurers' underwriting decisions.	To carry out the work the firm has engaged me for, such as speaking with you, progressing your mortgage or protection case, and liaising with lenders, insurers and solicitors for the firm. I act only on the firm's instructions. The firm is the controller and decides the lawful basis, which its own privacy notice explains.
Website visitors	Technical data your browser sends to load a page, such as your IP address, browser type and the page requested.	To deliver the site and keep it secure. Legitimate interests.
People who get in touch	Name, job title, firm, email, phone and what we discussed.	To reply and follow up. Legitimate interests in running and growing the business.
Client firms	Contact and billing details for the people I deal with, the signed agreement, and correspondence.	To deliver the work and invoice for it. Contract. To keep tax and accounting records. Legal obligation.
Staff at client firms	Names, roles, interview notes, how work flows through the team, and anonymised case timings.	To review the firm's processes and write its report. Legitimate interests of Salworth and the firm. Findings are about processes, not personal performance, unless the firm has told its staff otherwise.

Sensitive information

Health and lifestyle details, and some financial details, are especially private. When a firm's work involves them I:

only see or record them where the case genuinely needs it;
keep them on the firm's systems, never on Salworth's own systems, devices or personal notes;
never use them for anything other than the firm's work, and never for marketing;
never put them into any software or AI tool unless the firm has approved it in writing;
follow the firm's own rules for handling and sharing them.

Where it comes from

Most of it comes from you directly. Some comes from other people:

Customers of client firms: from you directly, from the firm's own records and systems when it asks me to work on your case, and from lenders, insurers and solicitors involved in your case.
Staff at client firms: names, roles and working patterns come from your employer when it engages me, and from what you tell me in interviews and walk-throughs.
Business contacts: from the person who introduced us, from events, or from public sources such as the FCA register, Companies House, LinkedIn and firms' own websites.

For Salworth's own purposes I don't collect special category data (such as health information), and I don't make automated decisions about people. Information I see while working for a client firm is covered by the box in section 2.

4. Cookies

This website sets no cookies and uses no analytics or tracking. The typefaces are served from this site, so no third party learns that you visited. There is no cookie banner because there is nothing to consent to.

5. Who I share it with

Customers of client firms

When I work for a firm, I share its customers' information only on that firm's instructions and through its own systems. This is with the people your case needs, such as:

lenders and insurers;
solicitors and conveyancers;
surveyors and valuers;
your GP or a medical examiner, where an insurer needs medical evidence and you have agreed to it through the insurer's own process;
the firm's advisers and staff;
the firm's network (if it has one), its auditors and regulators such as the FCA, where they ask to review the firm's work. This happens through the firm's own systems.

The firm's own privacy notice explains who it shares your information with and why.

Salworth's own business information

Only the service providers I need to run the business, each bound to protect your information:

Website hosting (Netlify), which processes technical data to serve the pages.
Email (Microsoft 365, supplied through GoDaddy) and domain registration (GoDaddy).
My bank and insurers, and an accountant if I use one, as needed.

I'll also share information if the law requires it. I never sell personal information or share it for anyone else's marketing.

6. Transfers outside the UK

Customers of client firms: I don't send their information outside the UK. It stays on the firm's own systems, and any transfers by those systems are covered by the firm's privacy notice.

Salworth's own business information: some of my service providers are based in, or use servers in, the United States. Where information leaves the UK, it is protected by the UK's adequacy regulations (including the UK–US data bridge) or the ICO's approved contract terms.

7. How long I keep it

Enquiries that don't lead to work: up to 2 years from our last contact.
Client engagement records: 6 years after the engagement ends, in case of any claim. These are Salworth's own records, such as the agreement, correspondence and invoices, not the firm's customer files.
Information I handle for a client firm: returned or deleted when the work ends, as the firm instructs.
Accounting records: 6 years, as the law requires.
Website technical logs: as long as the hosting provider keeps them, usually a few weeks.

After that, I delete it securely.

8. Keeping it safe

Business email and files are kept in password-protected accounts with two-factor sign-in. Devices are encrypted. A client firm's customer information stays on the firm's systems, and I follow its security and data protection policies while working with it. I keep notes to what the work actually needs.

9. Your rights

You can ask me to:

give you a copy of the information I hold about you;
correct it if it's wrong;
delete it;
restrict how I use it, or object to my using it;
send it to you or someone else in a portable format;
stop contacting you. I'll stop straight away.

Email steve@salworth.co.uk. It's free, and I'll reply within one month.

If you are a customer of a firm I work for, the firm decides how your information is used, so please make your request to the firm. If you send it to me instead, I'll pass it to the firm the same working day and help it respond.

10. Complaints

If you're unhappy with how I've handled your information, please tell me first so I can put it right. I'll acknowledge your complaint within 30 days, look into it properly, and tell you the outcome. If your complaint is about a firm I work for, I'll also pass it to the firm the same working day, and it will handle it under its own complaints process. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

11. Changes

If this notice changes, I'll update it here and change the date at the top.