Privacy Notice | Repton Estate Planning

Version 2026-10-18 · Effective when this version is published · Download this version

Earlier version dated 9 September 2026: view the archived version. This version applies from publication and does not change existing engagement terms or retrospectively alter earlier events.

This notice explains how Wealth Catalyst Limited, trading as Repton Estate Planning, handles personal information through its website and services.

Who we are and who this notice covers

Wealth Catalyst Limited, company number 09535864, is the controller of personal information collected for its website and services. Its registered office is 3 Repton Road, Earley, Reading, England, RG6 7LJ. Our privacy lead is Imran Ashraf. We have not designated a statutory Data Protection Officer; our privacy lead coordinates information requests and complaints.

This notice covers enquirers, prospective and existing clients, living family members and other people named in instructions, professional introducers and visitors to our website and tools. Information solely about a deceased person is generally outside UK GDPR; information about living people remains protected.

Information we use and where it comes from

Depending on your enquiry or agreed work, we may process contact and identity details, identity documents and photograph or likeness checks, evidence of address, family relationships, beneficiaries, wills, trusts, business interests, assets, gifts, financial information, meeting notes, instructions, correspondence, signed documents, payment records, risk assessments and relevant identity or sanctions checks. Website hosts may process technical and security information. We use health, capacity, religion or other sensitive information only where necessary and where an appropriate additional condition applies.

Information may come from you, a joint client, a professional introducer, public registers, an approved identity-check provider or another adviser where there is an appropriate basis. We minimise information about other living people and do not assume one client can authorise every use of another person's information.

Purposes and lawful bases

We use information to respond to enquiries, take steps you request before a contract, provide and document agreed services, verify identity and prevent fraud, meet legal obligations that apply, keep appropriate professional and business records, defend legal claims and secure our website. The lawful basis depends on the person and purpose.

Purpose	Basis and limit
Requested enquiry and agreed work for the contracting person	Steps requested before a contract or performance of a contract, where necessary (Article 6(1)(b)).
Necessary information about living relatives or beneficiaries who are not contracting parties	Legitimate interests (Article 6(1)(f)) after assessing necessity and their interests and rights.
Proportionate identity and fraud checks, administration, security and defending claims	Legitimate interests where assessed; legal obligation only for an identified duty that applies.
Applicable tax, sanctions or anti-money-laundering obligations	Legal obligation (Article 6(1)(c)) only where the specific obligation applies to the activity.
Optional electronic marketing	Separate opt-in and applicable electronic-marketing rules; consent can be withdrawn.

For special-category information, we identify both an Article 6 basis and a separate Article 9 condition for the activity. Explicit consent or the legal-claims condition may apply where their requirements are met; neither is assumed to cover every instruction or every living relative. We explain relevant choices and the implications of withdrawing consent where we rely on consent.

Marketing choices are separate from an enquiry, engagement or requested report. We use a separate affirmative opt-in for electronic marketing and provide a straightforward way to stop it in each marketing message. Asking for a report does not subscribe you to marketing.

Meetings, transcription and AI assistance

Manual checked notes are available as an alternative to assisted capture. We do not record audio or video by default. Before using recording, transcription or AI-assisted meeting tools, we explain what is captured, the purpose, supplier and relevant choices. We explain audio processing used to create notes even if no audio file is retained. We limit shared information, use approved business or API services with assessed supplier and access controls, and review assisted drafts before use. An unchecked AI draft is not professional advice or a final client document.

Recipients and providers

Where needed, information may be shared with your chosen professionals, legal or tax advisers, agreed file reviewers, will and document storage providers, identity-check providers, case-management and signing services, approved cloud, communications and meeting providers, and HMRC, the Office of the Public Guardian, courts or regulators where applicable. We use the role and agreement appropriate to each provider. We do not sell client-file information. Ask our privacy contact about recipients relevant to your work.

International transfers

Some providers may process information outside the UK. Where a restricted transfer occurs, we assess the applicable legal route and safeguards, such as UK adequacy regulations or approved transfer arrangements. We do not promise UK-only storage or that no transfer takes place. Provider-specific arrangements must match the account and service actually used.

Retention and security

Our normal policy periods are set out below. They are not a universal GDPR rule.

Record	Policy period
Enquiry that does not become an engagement	12 months after last meaningful contact, then delete or minimise.
General completed advisory file	6 years after completion, subject to adviser or insurer review and a documented need for longer retention.
Operative wills, trusts and essential drafting history	While operative or needed, with instrument-specific review after revocation, replacement, death or administration, or trust conclusion. A further 6 years applies only where appropriate to that instrument and insurer or legal obligations.
Corporate tax and financial records	Normally 6 years from the end of the relevant company financial year, subject to applicable tax-rule exceptions.
Anti-money-laundering / customer due diligence records	The applicable regulation 40 period, normally 5 years from the relevant statutory trigger, only where those rules apply.
Raw meeting recordings and transcripts	Delete within 30 days after checked notes are approved, unless a documented case need or legal hold applies. Checked notes follow the client-file schedule.
Marketing records	Review at least every 24 months; keep a minimal suppression record where needed to honour an objection.
Website and security logs and temporary workflow payloads	Our operating limit is 30 days unless a documented incident or necessary operational or legal purpose requires longer. Provider logs and backups may have separate technical retention.
Data-protection complaints records	6 years after closure, subject to necessity and adviser review.

We review whether information can be deleted or minimised. A documented legal hold or instrument-specific obligation may extend retention. Providers may retain technical logs and backups under their applicable schedules; we review those arrangements against these policy periods. We use access restrictions, controlled sharing, secure disposal and supplier review, and do not promise immediate erasure from every backup. Contact us for the retention criteria or period relevant to your record.

Your rights

Depending on the processing and applicable exemptions, you may request access or copies, correction, erasure, restriction or portability; object to processing, including direct marketing; or withdraw consent where it is the basis. We may ask for proportionate identity or authority evidence. You can object to legitimate-interests processing at any time, and we assess the request under applicable law. Tell us if a note or draft is inaccurate so it can be checked.

Data-protection complaints

You can complain by email, phone, post or another reasonable accessible channel. You do not need a special form or legal terminology. Our Data Protection Complaints Procedure explains how we acknowledge, investigate and respond. We acknowledge within 30 days, aim to acknowledge within 5 working days, investigate from receipt and communicate the outcome without undue delay. You may also complain to the Information Commissioner's Office (ICO); using our process does not affect that right.

Contact the ICO at ico.org.uk or call 0303 123 1113. Professional-service complaints follow their separate agreed procedure.

Website tools and cookies

Our online tools give general illustrations rather than personal professional advice. On-screen results do not require contact details. Where you choose a report or submit an enquiry, the form explains its purpose and keeps any optional marketing choice separate. The Cookie and Similar Technologies Notice explains applicable storage, statistics, third-party services and choices. Booking through an external service is a separate interaction with that provider.

Changes to this notice

We review this notice when services, providers, law or processing change. It shows its approved version and effective date, and previous versions remain available. We provide further information or choices where a material processing change requires them.