Who is responsible for your data?
Equibrook is the data controller for personal data collected on this website. That means we decide why and how your data is used on this website. Once the provider receives your details, it becomes a separate controller for its own use of them. You can reach us about privacy at privacy@equibrook.com.
- Controller: Equibrook
- Privacy contact: privacy@equibrook.com
What information do we collect?
We collect only what you type into the call-back form, a record of the consent you gave, and the technical logs every web server keeps. Anything else, such as analytics data, is collected only if you choose it. We don't ask for financial details, identity documents or sensitive information.
When you request a call back
- Your full name.
- Your email address.
- Your phone number.
- Which product or page you asked about.
Your consent record
When you tick a consent box we store what you agreed to, the exact version of the wording you saw, and the date and time.
Server and security logs
Like every website, our servers record your IP address, browser type, the pages requested, the referring page and the time of each request. We use these logs to keep the site running, to block abuse and to investigate security problems.
If you email or write to us
Your contact details, what you tell us and our reply.
All of this comes directly from you or your device.
Why do we use your data, and on what legal basis?
We use your data for the purposes in the table below, and data protection law requires a lawful basis for each. Passing your details to the provider relies on your consent, and so does anything optional, such as analytics. Keeping consent records and security logs relies on legal obligation or our legitimate interests.
Where we rely on legitimate interests, we have weighed our interest against your rights and expectations, and you have the right to object (see your rights). You can ask us for a copy of that assessment.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Passing your details to the provider so it can call you back | Name, email, phone, product of interest, consent timestamp | Consent. You give it by ticking the box on the form. |
| Keeping a record of your consent | Consent wording version, date and time, the details it relates to | Legal obligation, because data protection law requires us to be able to show that you consented; and legitimate interests in defending legal claims. |
| Preventing fraud and misuse of the call-back form | The details in your request, and the time and network (IP) address it came from | Legitimate interests in protecting you, the provider and us from fraud; legal obligation where the law requires us to report a suspicion. |
| Keeping the site secure and working | Server and security logs | Legitimate interests: protecting the site, our visitors and our systems from misuse and attacks. |
| Answering your messages, complaints and rights requests | Contact details and correspondence | Legal obligation for rights requests; legitimate interests in replying to you and keeping a record of what we said. |
Who receives your data?
If you ask for a call back, your details go to the provider and to nobody else. From the moment it receives them, the provider is an independent controller and its own privacy notice applies. Otherwise only our service providers handle your data, under contract and on our instructions.
The provider (independent controller)
We pass your name, email address, phone number, the product you asked about and the time you gave consent, and only if you ticked the consent box. The provider decides for itself how to use that data, for example to call you, carry out identity and other checks it must make, and open an account if you go ahead. Its own privacy notice explains this; you can find it on the provider's website. Full details: who receives your details.
Service providers (processors)
These companies act only on our instructions, under a written contract that meets the requirements of data protection law. They may not use your data for their own purposes.
| Category | What they do |
|---|---|
| Website hosting | Stores and serves the website and its server logs |
| Form handling and database | Receives and stores call-back requests and consent records |
| Email delivery | Sends emails to you and to the provider |
We may also share data with our professional advisers (lawyers, accountants and auditors) under a duty of confidentiality, and with courts, public authorities or the police where the law requires us to. We never sell your personal data and never share it with anyone else for marketing.
Is your data sent to other countries?
If a service provider stores or accesses your data outside the UK or the European Economic Area, we use it only where that country has an adequacy decision or where the European Commission's standard contractual clauses (with the UK addendum for UK data) are in place.
You can ask us at privacy@equibrook.com for a copy of the safeguard.
How long do we keep your data?
We keep call-back requests for 24 months and consent records for 72 months, so we can answer questions and show that you agreed. Other data is kept for shorter periods, set out in the table. When a period ends, we delete the data or make it permanently anonymous.
| Data | How long | Why that long |
|---|---|---|
| Call-back requests (name, email, phone) | 24 months from the request | To deal with questions, complaints or disputes about the introduction. |
| Consent records | 72 months from the date of consent | To prove consent if it is ever questioned, within the time limits for legal claims. |
| Server and security logs | 30 days | Long enough to spot and investigate attacks and faults. |
| Emails, complaints and rights requests | 6 years after the matter is closed | To show how we handled the matter. |
If you withdraw consent or ask us to delete your data, we delete it sooner, except for the minimum we must keep to show we acted on your request. The provider sets its own retention periods for the copy it holds.
What are your rights?
You have the right to see the data we hold about you, correct it, have it deleted, restrict how we use it, receive it in a portable format and object to our use of it. You can withdraw consent at any time. Email privacy@equibrook.com; it's free, and we aim to reply within one month.
We aim to reply within one month, or sooner if the law where you live sets a shorter deadline. If a request is complex or you've sent several, we may need longer. If so, we'll tell you why within the first month and say when to expect a full reply. We may ask you to confirm your identity before we act, so that we don't give your data to someone else.
When we correct, delete or restrict your data, we also tell the provider if we passed it to them, unless that is impossible or would take disproportionate effort. Depending on where you live, you may have additional rights.
- Access: ask for a copy of the personal data we hold about you and how we use it.
- Rectification: ask us to correct data that is wrong or incomplete.
- Erasure: ask us to delete your data, for example when we no longer need it or you withdraw consent.
- Restriction: ask us to keep your data but stop using it, for example while we check a correction.
- Portability: receive the data you gave us, where we use it based on consent, in a common machine-readable format, or ask us to send it to someone else.
- Objection: object to any use based on legitimate interests. We must then stop unless we have compelling grounds or need the data for a legal claim.
- Withdraw consent at any time: for the call back, or for anything optional you agreed to. This doesn't make anything we did before you withdrew unlawful.
- Complain: to a data protection authority, in particular in the country where you live, work or where you think the problem happened. See how to complain.
How to use your rights or withdraw consent
- Call back: email privacy@equibrook.com. We stop using your details, delete them (apart from the record of your request) and tell the provider that you've withdrawn. Because the provider is a separate controller, you can also contact it directly.
- Newsletter: use the unsubscribe link in any email, or email privacy@equibrook.com.
- Analytics: use the 'Change my cookie settings' button on the cookie policy or the 'Cookie settings' link in the footer.
Do we make automated decisions about you?
No. We don't make any decision about you based solely on automated processing, including profiling, that has legal or similarly significant effects on you. The provider may carry out its own checks once you speak to it; its privacy notice explains them.
How do you complain about our use of your data?
Please contact us first at privacy@equibrook.com so we can try to put things right. Our complaints page explains how we handle complaints and how long it takes.
You also have the right to complain to a data protection authority, in particular in the country where you live, work or where you think the problem happened. The authority's website will explain how to make a complaint. You don't have to come to us first, but it often resolves things faster.
Do you have to give us your details?
No. You can read every page of Equibrook without giving us any personal data. There is no legal or contractual requirement to provide it. We need your name, email address and phone number only if you want the provider to call you back; without them, we can't arrange the call.
How do we keep your data safe?
The site uses HTTPS encryption, and access to stored data is limited to the people who need it.
Call-back requests go to the provider over an encrypted connection.
No system is perfectly secure, so if we ever have a breach that risks your rights, we will tell you and the data protection authority where the law requires it.
Children
Equibrook is not intended for anyone under 18, and the investment products it describes are available only to adults. We don't knowingly collect data from children. If you believe a child has sent us their details, email privacy@equibrook.com and we will delete them.
Additional rights depending on where you live
Some countries, and some states or regions within them, give residents privacy rights on top of those above, or describe them in different terms. This section explains how we handle those extra rights wherever they apply to you.
- Categories we collect: identifiers (name, email address, phone number, IP address) and internet activity (server logs, and analytics data only if you opt in). We collect no sensitive personal information, such as health details, financial account numbers or identity documents.
- Sources and purposes: directly from you and your device, for the purposes set out in why we use your data. Retention periods are in how long we keep your data.
- Disclosure: we disclose your identifiers to the provider only when you direct us to by requesting a call back, and to our service providers for business purposes.
- No selling or sharing: we don't sell your personal information and don't share it for cross-context behavioural advertising. We have not done so in the past 12 months.
- Global Privacy Control: we treat a GPC signal from your browser as a valid request to opt out of any sale or sharing of your data, and analytics stays off.
- Your rights: where local law gives them, to know what we collect and disclose, to access, correct and delete it, and to opt out of sale or sharing. We won't treat you differently for using any privacy right.
- How to make a request: email privacy@equibrook.com. We will verify your identity by matching details you give us with what we hold. Someone else may make a request for you if they show your signed permission.
Changes to this policy
We update this policy when the law, our services or our providers change. The date of the latest review is shown on this page. If a change affects how we use data you've already given us, we will tell you by email before it takes effect and, where needed, ask for your consent again.
Review history
Version 1.0, in force from 16 October 2026: first published.
This policy is reviewed at least once a year and whenever our data use changes.