a) Registration Information - When you register on the Sesame Bankhall websites, you may have to provide your name, FCA number, your email address, and some optional notes about yourself ("Registration Information"). They are available to you, and capable of being changed.

When you submit an enquiry through our contact form, we collect and use your personal information to respond to your request and administer our services. Where you choose to receive marketing communications, or where permitted by applicable law including the Privacy and Electronic Communications Regulations (PECR), we may contact you about relevant products, services, and updates. You can opt out of marketing communications at any time.

In limited circumstances we may process special category personal data, including information concerning health, where necessary to comply with legal obligations, establish or defend legal claims, support vulnerable customers or where another condition under Article 9 UK GDPR applies.

b) Cookies

We use cookies and similar technologies to operate our websites and improve user experience. Strictly necessary cookies are used without consent where permitted by law.

Non-essential cookies will only be placed on your device where you have actively consented through our cookie preference management tool. You may change your preferences at any time.

Cookies are small files of letters or numbers that we put on your computer. We use these types of cookies on our websites:

● Strictly necessary cookies: these cookies are essential for your use of our websites and identify that you are logged in when using secure areas of our sites.

● Performance cookies: these cookies collect anonymous statistics about how people/visitors use our sites and which pages are the most popular. These cookies help us to improve the sites.

● Functionality cookies: these cookies help you to use our websites. They store information about choices you make or information you give. They are also used when you watch a video and also to remember your login information.

● Targeting cookies: these cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

● You can set your cookie preferences on our website through the popup banner or make change to settings on your browser to block cookies if you wish. Please be assured Sesame Bankhall Group takes the utmost care to ensure that cookies and any associated information is secure and handled in accordance with data protection legislation.

We use a cookie preference management tool which allows you to accept or reject non-essential cookies. Non-essential cookies will only be placed on your device where you have provided your consent. You may withdraw that consent at any time via the cookie settings link available on our website.

Other files types we may process include:

Log files - Like most standard Web site servers we use log files. This includes internet protocol (IP) addresses, browser type, internet service provider (ISP), referring/exit pages, platform type, date/time stamp, and number of clicks to analyse trends, administer the site, track user's movement in the aggregate, and gather broad demographic information for aggregate use. IP addresses, etc. may be linked to personally identifiable information. (IP addresses are tied to personally identifiable information to enable our Web-based service).

The over-riding principle we apply is that we supply your personal data to product providers so that you can transact business with them and so that you are identified for the receipt of commissions. However, we do not sell lists of our Members' email addresses to other third parties. We may pass your details to a third party if you request a product from a third party supplier through the Sesame, Bankhall or PMS buying clubs.

• Email addresses - We do not directly make your email address available to anyone on any screen on the Sesame, Bankhall and PMS Websites and microsites. The only legitimate way of making contact with you is from Product Providers and via third party suppliers through the Sesame buying club. We make your e-mail address available to other members of the Sesame Bankhall and PMS propositions and in some instances we make it available to product providers. If you do not want your e-mail address given to other members of the Bankhall and PMS propositions or to product providers and other carefully selected third party suppliers please call our Contact Centre or your usual helpdesk who will be happy to help you opt-out of one or more of these facilities.

• Advertising - The Sesame, Bankhall and PMS website and their microsites may include interactive advertising for other businesses. We may use, and provide to third parties, anonymised demographic data provided by Members of the Sesame, Bankhall and PMS propositions to target this advertising more appropriately. Where required by law, we will obtain your consent before sending electronic direct marketing communications. Where we rely upon the soft opt-in provisions under the Privacy and Electronic Communications Regulations, individuals will have the opportunity to opt out both when data is collected and in each subsequent marketing communication.

• Newsletters - We have regular and occasional emails, which all members of Sesame, Bankhall and PMS propositions receive, typically these will be compliance bulletins, research if you take that and other materials relevant to your contract as a member of the Sesame, Bankhall and PMS propositions.

• Companies in the Sesame Bankhall Group - We may share data supplied by you (or collected about you) with our subsidiaries and other companies in our group, but only for the purposes described in this policy and Sesame Bankhall Group Website Terms and Conditions.

• Changes in Sesame Bankhall businesses - If the businesses of Sesame Bankhall Group Limited are transferred to other legal entities or are acquired by a third party, we may transfer personal data we then hold to that party.

• Place of processing - The personal information held by us is held on and processed by computers situated in the United Kingdom.

• We process personal information for a variety of purposes relating to the operation of our websites, services and regulatory obligations. This includes administering website accounts and registrations where processing is necessary for the performance of a contract; respond-ing to enquiries and information requests where processing is necessary to take steps prior to entering into a contract or is in our legitimate interests; sending marketing communica-tions where we have your consent or are otherwise permitted to do so under the Privacy and Electronic Communications Regulations (PECR); protecting the security of our websites, systems and services through our legitimate interests in maintaining secure and resilient platforms; carrying out regulatory monitoring and compliance activities where required to

  meet our legal and regulatory obligations; and preventing, detecting and investigating fraud, financial crime and other unlawful activities where this is necessary to comply with legal obligations and pursue our legitimate interests in protecting our business, customers and authorised representatives.

• We may also process personal infoinformation to comply with our regulatory obligations, in-cluding Consumer Duty monitoring, complaint handling, financial crime prevention, sanc-tions screening, fraud prevention, vulnerable customer assessments, regulatory reporting and responding to requests from regulators, law enforcement agencies and competent authorities.

Recipients of personal information may include:

• Product providers and insurers

• Mortgage lenders

• Technology and cloud service providers

• Professional advisers such as legal and audit firms

• Financial crime screening providers

• Regulatory bodies including the FCA, ICO and Financial Ombudsman Service

• Companies within the Sesame Bankhall Group

• Approved AI and technology providers subject to appropriate contractual safeguards

We do not currently make decisions that produce legal or similarly significant effects solely through automated means. Where this changes, individuals will be informed of their rights and provided with the safeguards required by applicable law.

We have security measures in place to protect our customer database and access to this database is under strict guidelines. However, it remains each Member's responsibility:

• to protect against unauthorised access to its website access details;

• to ensure against use by anyone else of the Sesame, Bankhall and PMS websites and microsites through the machine that Member uses while they are logged on to the Sesame, Bankhall and PMS websites and/or microsites;

• to log off or exit from the Sesame, Bankhall and PMS website and/or microsites when not using it; and

• to keep passwords complex, secret and unique.

Some personal information may be processed outside the UK. Where this occurs, we ensure appropriate safeguards are implemented, including UK International Data Transfer Agreements (IDTAs), UK Addendums to Standard Contractual Clauses, adequacy decisions, or other approved transfer mechanisms.

• You may have your registration details removed from our Websites at any time. To remove yourself please call our Contact Centre or your helpdesk and they will tell you how we remove Your Details.

• We provide Members with the opportunity not to receive e-mailed Newsletters and other correspondence that they have previously opted to receive. This opt-out can be effected by calling our Contact Centre or your helpdesk.

We reserve the right to communicate such of a Member's personal information as we hold to third parties which seek the disclosure of it, and which make a legally-compliant request for its disclosure.

If you have any questions about this privacy statement, the practices of this site, or your dealings with Sesame Bankhall Group, you should call our Contact Centre or your helpdesk. You can also call our Contact Centre to get a copy of the personal data we hold about you or a description of that data. We will normally provide copies of personal information free of charge. However, we may charge a reasonable fee or refuse a request where it is manifestly unfounded, excessive or repetitive, as permitted by applicable data protection legislation.

Under GDPR you have the following rights:

• Right of access

• Right to rectification

• Right to erasure

• Right to restrict processing

• Right to object

• Right to data portability

• Rights relating to automated decision making

• Right to complain to the ICO

If you change any of your personal details or you want us to correct any personally identifiable information you should contact our Data Privacy team and we will endeavour to make the changes you request.

You have the right to lodge a complaint with the Information Commissioner's Office (www.ico.org.uk) if you believe your personal information has been processed unlawfully

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, regulatory, tax, accounting and reporting requirements. Retention periods vary depending on the nature of the information and the purpose of processing.

Typical retention periods include:

• Website registration records: duration of registration plus up to 6 years

• Contact enquiries: up to 3 years

• Technical website logs: up to 12 months

• Marketing suppression records: whilst required to maintain your preferences

• Regulatory and compliance records: in accordance with applicable FCA and legal retention requirements

Our site contains links to other sites. Sesame Bankhall Group is not responsible for the privacy practices, or the content, of those web sites.

You can obtain further information about data protection laws by visiting the Information Commissioner's website at www.ico.gov.uk.

You can search for our Data Protection Notification and registration there, should you so wish.

If we change our privacy policy, we will post those changes to our homepage and any other place we deem appropriate. After we have posted changes, if you use the Sesame, Bankhall and PMS websites or any microsite within them you will be bound by the terms of change to our new privacy policy.

Sesame Bankhall Group may use approved artificial intelligence systems, including generative AI and machine learning technologies, to assist with document review, quality assurance, compliance monitoring, complaint investigations, operational administration, analytics and service improvement activities. Personal information processed through such systems remains subject to appropriate contractual, technical and organisational safeguards, including access controls, confidentiality requirements, human oversight and information security measures. We do not make decisions that produce legal or similarly significant effects solely

through automated processing. These technologies are used to assist employees and authorised personnel rather than replace human decision making.

Should this position change, we will update this notice and provide any additional information required by applicable data protection laws.

Remember to close your browser when you have finished your user session. This is to ensure that others cannot access your personal information and correspondence if you share a computer with someone else or are using a computer in a public place like a library or Internet cafe. You as an individual are responsible for the security of, and access to, your own computer.

Please be aware that whenever you voluntarily disclose personal information over the Internet that this information can be collected and used by others. In short, if you post personal information in publicly accessible online forums, you may receive unsolicited messages from other parties in return. Please be careful and responsible whenever you are using the Internet.

This part of the Privacy Policy applies when you access the Bankhall website via www.bankhall.co.uk or the PMS website via www.trustpms.com (the “Portal”).

You and we agree to comply with our respective obligations under data protection and privacy laws. You are data controller and we are data processors of the data you pass to us. You warrant that you can pass your client’s data to us and product providers for processing on Bankhall Online and particularly via Adviser Hub. We will process that data in accordance only with your instructions. We may only use the data outside of your instructions to comply with our legal responsibilities or upon receipt of a legally valid request from your regulators and other appropriate authorities.

We warrant that we have technical and organisational measures in place to protect personal data and keep it secure and safe from accidental loss, destruction and damage.

We warrant that we have taken reasonable steps to ensure the reliability of our employees who may have access to the personal data you submit via Bankhall Online and Adviser Hub.

You acknowledge that you may send the personal data to third parties for them to supply you with quotes and other products and services that may be suitable for you clients and therefore we are not liable for the loss, damage or destruction of personal data you load or any message you send to third parties.

Sesame Bankhall Group Limited: company number 3573352.

Each company is registered in England & Wales with a registered address:

Aviva, Wellington Row, York, YO90 1WR