Data Protection Policy

Introduction

This Data Protection Policy outlines the principles and practices that govern the collection, processing, and protection of personal data by Core Financial Paraplanning Limited, specifically in the context of paraplanning activities. This policy is designed to ensure compliance with applicable data protection laws and regulations, including but not limited to the General Data Protection Regulation (GDPR).

Scope

This policy applies to all employees, contractors, and third parties who process personal data on behalf of Core Financial Paraplanning Limited in the course of paraplanning activities.
Personal data is defined as any information that relates to an identified or identifiable natural person.

Data Collecting and Processing

Lawful Basis for Processing
Personal data will only be processed when there is a lawful basis for doing so. Common lawful bases include the necessity of processing for the performance of a contract, compliance with
legal obligations, protection of vital interests, consent, the performance of a task carried out in the public interest or in the exercise of official authority, and legitimate interests pursued
by the data controller or a third party.

Data Minimisation
Only the minimum amount of personal data necessary for the intended purpose will be collected and processed.

Purpose Limitation
Personal data will only be processed for the specific purposes for which it was collected.

Accuracy
Reasonable steps will be taken to ensure that personal data is accurate, complete, and up-todate.

Data Security

Confidentiality
Personal data will be treated as confidential, and access will be restricted to individuals who need it for the purposes for which it was collected.

Data Access Controls
Access to personal data will be limited to authorised personnel, and strict access controls will be implemented.

Data Encryption
Personal data, especially during transmission and storage, will be encrypted to ensure its confidentiality and integrity.

Data Subject Rights

Access and Corrections
Data subjects have the right to access their personal data and request corrections where necessary.

Erasure
Data subjects have the right to request the erasure of their personal data under certain conditions.

Data Portability
Data subjects have the right to receive their personal data in a structured, commonly used, and machine-readable format.

Data Breach Response

Reporting
Any suspected or confirmed data breaches will be promptly reported to the Data Protection Officer and, where required, to the relevant supervisory authority and affected data subjects.

Investigation and Mitigation
A thorough investigation will be conducted in the event of a data breach, and appropriate measures will be taken to mitigate the impact and prevent future occurrences.

Training and Awareness

Employee / Contractor Training
All employees and relevant third parties will receive training on data protection principles and their responsibilities under this policy.

Awareness Programmes
Regular awareness programmes will be conducted to keep personnel informed about updates to data protection laws and policies.

Compliance Monitoring

Internal Audits
Regular internal audits will be conducted to assess compliance with this policy and relevant data protection laws.

Policy Review
This policy will be reviewed periodically and updated as necessary to ensure continued compliance with applicable laws and regulations.

Data Protection Officer

Appointments
A Data Protection Officer (DPO) will be appointed to oversee and ensure compliance with this policy and relevant data protection laws.

Contact Information
The contact details of the DPO will be made available to all employees and data subjects.

Conclusion

This Data Protection Policy reflects Core Financial Paraplanning Limited’s commitment to protecting the privacy and rights of individuals whose personal data is processed in the course  of paraplanning activities. All personnel are expected to adhere to the principles and practices outlined in this policy to maintain the trust and confidence of data subjects and comply with applicable data protection laws.