Rockstone Compliance Privacy Policy

RockstoneCompliance Limited

PrivacyNotice

Last updated: 12 October 2026

1.Introduction

Rockstone Compliance Limited("Rockstone", "we", "us" or "our") iscommitted to protecting personal information and respecting the privacy ofindividuals whose data we process.

This Privacy Notice explains how we collect,use, process, store, share and protect personal information in connection withour regulatory compliance consultancy services, websites, online CompliancePlatform and associated business activities.

We process personal data in accordance withapplicable UK data protection legislation, including:

• The UK General Data Protection Regulation (UK GDPR);
• The Data Protection Act 2018, as amended;
• The Data (Use and Access) Act 2025, where applicable; and
• The Privacy and Electronic Communications Regulations 2003 (PECR).

This Privacy Notice applies to our clients,prospective clients, advisers, employees and representatives of client firms,contractors, website visitors, Compliance Platform users and other individualswhose personal information we may process.

It covers our websites and online services,including:

• www.rockstonecompliance.co.uk
• www.mortgagecompliance.co.uk
• www.creditbrokingcompliance.co.uk
• www.rockstonecomplianceportal.co.uk

It also applies to information receivedthrough email, telephone, video conferencing, electronic documents, onlineforms and other business communications.

2. Who weare

Company Name: Rockstone Compliance Limited

Registered Company Number: 09905181

Website: www.rockstonecompliance.co.uk

Email: info@rockstonecompliance.co.uk

Telephone: 0333 4443103

Data Protection Contact: Elizabeth Harris

Email: elizabeth.harris@rockstonecompliance.co.uk

Rockstone provides regulatory complianceconsultancy, oversight and support to businesses operating within the financialservices sector.

Our services include compliance monitoring,file reviews, regulatory applications, training and competence support, adviseronboarding, background screening coordination, financial crime compliance,complaints support and other regulatory consultancy activities.

3. Our roleas a data controller and data processor

Our responsibilities under data protectionlegislation depend on the nature of the information being processed and theservices being provided.

Where Rockstone acts as a data controller

Rockstone acts as a data controller whendetermining the purposes and means of processing personal information relatingto its own business operations.

This may include information relating to:

• Client and prospective client relationships;
• Business contacts and correspondence;
• Employees, contractors and recruitment;
• Invoicing, payments and accounting;
• Marketing and business development;
• Website visitors and enquiries;
• Management and security of our systems and services.

Where Rockstone acts as a data processor

When providing compliance consultancy servicesthat involve reviewing personal information belonging to a client firm'scustomers, employees or advisers, Rockstone generally acts as a data processoron behalf of that firm.

The client firm remains the data controllerand is responsible for determining the lawful basis for processing personalinformation and providing relevant privacy information to affected individuals.

Rockstone processes this information for thepurposes of delivering the services instructed by the client firm, inaccordance with applicable contractual arrangements, documented instructionsand legal requirements.

Where appropriate, data processing agreementsand other contractual safeguards are maintained between Rockstone and itsclient firms.

4. Personalinformation we process

The information we process depends on theservices provided and the nature of our relationship with the individual orclient firm.

This may include:

Personal and contact information

• Names, titles and contact details;
• Business and residential addresses where relevant;
• Email addresses and telephone numbers;
• Date of birth and identity information where required.

Professional and employment information

• Employer, occupation and job title;
• Employment history and references;
• Professional qualifications and experience;
• FCA registration and regulatory status;
• Training, competence and CPD records;
• Adviser supervision and performance information;
• Background screening and suitability information.

Regulatory and compliance information

• Compliance monitoring and audit records;
• Mortgage, insurance and other financial advice documentation;
• File review findings and quality assurance reports;
• Complaints and investigation documentation;
• Regulatory applications and correspondence;
• Financial crime and due diligence information;
• Compliance registers and declarations;
• Training assessments and knowledge test results.

Business and financial information

• Business financial information and forecasts;
• Regulatory returns and supporting documentation;
• Contractual information;
• Billing, invoicing and payment information.

Technical and platform information

• IP addresses and device information;
• Browser and operating system information;
• Platform login and authentication records;
• Access permissions and user activity;
• Security and audit logs;
• Website usage information and cookies.

Communications information

• Emails and business correspondence;
• Meeting notes and enquiries;
• Feedback and survey responses;
• Marketing preferences.

In limited circumstances, we may processspecial category personal data or criminal offence information, particularly inconnection with complaints, due diligence, regulatory investigations or advisersuitability assessments.

Such information will only be processed wherean appropriate lawful basis and any additional legal condition have beenidentified, and appropriate safeguards are applied.

5. How wecollect personal information

We may obtain personal information:

• Directly from individuals who contact or engage with us;
• From client firms and their authorised representatives;
• Through access to client CRM and case management systems;
• Through our websites and Compliance Platform;
• From documents submitted for compliance reviews;
• Through regulatory applications and correspondence;
• From background screening and verification providers;
• From professional references and employment records;
• From publicly available sources, including Companies House and the     FCA Financial Services Register;
• Through meetings, emails and other business communications.

Client firms are responsible for ensuring thatpersonal information provided to Rockstone is shared lawfully and isappropriate for the services being undertaken.

6. How weuse personal information

We process personal information for purposesincluding:

• Delivering regulatory compliance consultancy services;
• Conducting file reviews and compliance audits;
• Providing training and competence support;
• Assisting with regulatory applications and submissions;
• Supporting complaints handling and investigations;
• Assisting with adviser onboarding and background screening;
• Maintaining compliance monitoring records and reports;
• Operating and maintaining our Compliance Platform;
• Managing client relationships and contractual obligations;
• Processing payments and maintaining accounting records;
• Responding to enquiries and providing regulatory updates;
• Maintaining information security and preventing unauthorised     access;
• Improving our services, systems and administrative processes.

We seek to limit our processing to informationreasonably necessary for the relevant purpose.

7. Lawfulbases for processing

Where Rockstone acts as a data controller, werely on one or more of the following lawful bases under Article 6 of the UKGDPR:

Contractual necessity

Where processing is necessary to enter into orperform a contract with an individual.

Legal obligation

Where processing is necessary to comply withapplicable legal requirements.

Legitimate interests

Where processing is necessary for ourlegitimate business interests, or those of a third party, provided theseinterests are not overridden by the rights and freedoms of affectedindividuals.

Such interests may include delivering servicesto client firms, maintaining business relationships, improving systems,protecting information and managing regulatory risks.

Consent

Where consent is required for a particularactivity, we will request it and provide an appropriate mechanism forwithdrawal.

Where special category personal data orcriminal offence information is processed, the additional conditions requiredunder applicable legislation will be identified and applied.

Where Rockstone acts as a data processor, therelevant client firm is responsible for establishing the lawful basis forprocessing, while Rockstone processes information in accordance with the firm'sdocumented instructions and applicable legal obligations.

8.Processing of client customer information and file reviews

Rockstone recognises that complianceconsultancy activities may involve access to confidential and sensitivecustomer information held by regulated financial services firms.

We operate on the principle of dataminimisation and seek to avoid unnecessary collection, duplication andretention of personal information.

Access through client systems

Wherever possible, compliance reviews areundertaken directly through the client firm's existing CRM, document managementor case management system.

This allows Rockstone to review relevantinformation without unnecessarily transferring or retaining copies ofunderlying customer files.

Information provided by email

Where customer documentation is provided toRockstone by email or other electronic means, it is used for the specificcompliance activity requested.

Once the relevant activity has been completed,the underlying customer documentation is deleted from Rockstone's workingrecords in accordance with our procedures, subject to applicable legalpreservation requirements and any residual technical backup arrangements.

Retention of compliance findings

Rockstone does not routinely maintain aseparate archive of customer advice files supplied solely for compliance reviewpurposes.

However, we may retain our own compliancefindings, audit reports, recommendations, monitoring outcomes and relatedbusiness records where necessary to evidence the services provided.

Such records are subject to appropriate dataminimisation, access controls and retention arrangements.

The client firm remains responsible formaintaining its own customer records and meeting applicable FCA and statutoryrecordkeeping obligations.

9. Use ofartificial intelligence (AI)

Rockstone uses artificial intelligencetechnologies to support its regulatory compliance consultancy services andinternal business operations.

These include paid business subscriptions to:

• ChatGPT, provided by OpenAI;
• Claude, provided by Anthropic.

Other AI-assisted technologies may beintroduced where appropriate, following consideration of relevant dataprotection, confidentiality and security requirements.

How AI is used

AI technologies may assist with:

• Regulatory research and interpretation;
• Drafting compliance documentation and reports;
• Reviewing policies, procedures and written materials;
• Preparing training materials and regulatory communications;
• Summarising information;
• Identifying potential compliance considerations;
• Improving administrative efficiency;
• Supporting internal business processes.

Human oversight and professionalaccountability

AI is used as a supporting tool and does notreplace professional judgement.

Rockstone remains responsible for thecompliance advice, assessments, recommendations and services it provides.

AI-assisted outputs are subject to appropriatehuman review before being relied upon for professional or regulatory purposes.

We do not use AI to make solely automateddecisions that produce legal or similarly significant effects on individuals.

Confidentiality and data protection

Rockstone uses business-grade AI services withcontractual and technical privacy safeguards.

The business subscriptions used by Rockstoneprovide protections restricting the use of customer inputs and outputs forgeneral model training, in accordance with the relevant providers' commercialterms and applicable account settings.

When using AI technologies, we apply thefollowing principles:

• Personal information is minimised wherever practicable;
• Information is anonymised or redacted where reasonably possible;
• Confidential information is handled in accordance with applicable     data protection and contractual obligations;
• Access to AI services is restricted to authorised users;
• Information is submitted only where there is an appropriate purpose     and lawful basis;
• AI-generated material is subject to human oversight and     verification;
• AI service providers and their data processing arrangements are     kept under review.

Where AI technologies are used to processpersonal information on behalf of client firms, such processing must bepermitted by the relevant contractual arrangements and any applicablesubprocessor requirements.

AI data storage and processing

AI service providers may process ortemporarily retain information using infrastructure located outside the UnitedKingdom.

The processing locations, retentionarrangements and security measures will depend on the relevant service,contractual arrangements and account configuration.

Rockstone will take appropriate steps toensure that any international processing of personal information complies withUK data protection requirements.

The use of AI does not remove Rockstone'sconfidentiality, professional or data protection obligations.

10.Rockstone Compliance Platform

Rockstone operates an online CompliancePlatform accessible at:

www.rockstonecomplianceportal.co.uk

The platform supports regulated firms inmanaging compliance responsibilities, maintaining regulatory records andaccessing compliance-related services.

Depending on the functionality used, theplatform may contain:

• Firm and adviser details;
• Compliance monitoring records;
• File review findings and outcomes;
• Training and competence information;
• CPD records;
• Knowledge test results;
• Complaints registers;
• Gifts and hospitality registers;
• Financial promotions records;
• Regulatory declarations;
• Compliance documentation;
• User access and system activity information.

Platform security

Access to the platform is restricted toauthorised users through individual user accounts and appropriateauthentication controls.

Security measures include access permissions,authentication controls and other appropriate technical and organisationalsafeguards.

Users and client firms are responsible formaintaining the confidentiality of their login credentials and ensuring thatinformation uploaded to the platform is appropriate and lawfully processed.

11. Datahosting and storage arrangements

Rockstone uses secure cloud-based technologyto support its business operations and Compliance Platform.

Our Compliance Platform uses Google Cloudinfrastructure.

UK-based document storage

Our Google Cloud configuration includesUK-based storage for key platform resources.

The following storage arrangements have beenidentified:

• The Compliance Platform document library is configured in Google's     London region, europe-west2.
• The client uploads storage bucket is configured in Google's London     region, europe-west2.
• Associated infrastructure configuration storage is also configured     in the London region.

These arrangements support the storage ofrelevant platform documents and uploaded files within UK-based infrastructure.

Other technical infrastructure

Certain supporting Google Cloud servicesoperate using infrastructure outside the UK.

For example, a Cloud Build storage bucketassociated with the platform is configured in Google's United Statesmulti-region.

This supports technical development anddeployment processes and is not identified as the primary location for storingclient documents.

Other components of the platform, includingdatabases, authentication systems, backups, technical logs and supportservices, may have separate storage or processing arrangements.

Accordingly, although key document storage isconfigured within the UK, Rockstone does not represent that all personalinformation processed through the platform or associated technology providersremains exclusively within the United Kingdom.

International data transfers

Where personal information is transferred toor accessed from a country outside the UK, we will ensure that an appropriatelegal transfer mechanism is in place where required.

This may include UK adequacy regulations, theUK International Data Transfer Agreement, the UK Addendum to the EU StandardContractual Clauses or another lawful transfer mechanism, together with anyadditional safeguards required.

We keep third-party processing and hostingarrangements under review.

12.Information security

Rockstone takes reasonable and proportionatetechnical and organisational measures to protect personal information againstunauthorised access, loss, misuse, alteration or disclosure.

These measures may include:

• Secure cloud-based systems;
• Restricted and role-based access permissions;
• Multi-factor authentication;
• Encryption and secure communications;
• Appropriate password and account security;
• Confidentiality obligations;
• Data protection awareness;
• Supplier due diligence;
• Secure document handling and deletion;
• Monitoring and responding to security incidents.

We periodically review our informationsecurity arrangements and take appropriate action where improvements areidentified.

Where a personal data breach occurs, we willinvestigate and respond in accordance with applicable legal obligations,including notifying affected client firms, the Information Commissioner'sOffice or individuals where required.

Although reasonable precautions are taken, noelectronic system or method of transmission can be guaranteed to be entirelyfree from risk.

13. Sharinginformation with third parties

We may share personal information with thirdparties where necessary to provide our services, operate our business or complywith applicable legal requirements.

These may include:

• Cloud hosting and IT infrastructure providers;
• Compliance Platform developers and support providers;
• Approved AI technology providers;
• Background screening and identity verification providers;
• Accounting, billing and payment processing providers;
• Professional advisers, insurers and legal representatives;
• Client firms and their authorised representatives;
• Regulators and public authorities where appropriate;
• Law enforcement agencies where legally required.

Where third parties process personalinformation on our behalf, appropriate contractual arrangements and securitymeasures will be applied as required by law.

We do not sell personal information to thirdparties.

We do not share personal information forunrelated third-party marketing purposes without an appropriate lawful basis.

14. Dataretention and deletion

Rockstone seeks to retain personal informationonly for as long as necessary for the purposes for which it was obtained.

Retention arrangements depend on the nature ofthe information and the legal, regulatory and contractual requirements thatapply.

Customer advice files

Customer files accessed through client CRMsystems are not routinely copied or retained by Rockstone.

Where customer documents are supplied by emailfor compliance reviews, they are deleted from Rockstone's working recordsfollowing completion of the relevant activity, subject to applicable legalrequirements and technical backup arrangements.

Compliance records

Rockstone may retain its own file reviewfindings, compliance monitoring reports, audit outcomes and related recordswhere necessary to evidence services provided and fulfil legitimate business,contractual or legal purposes.

Business and administrative records

Client contact details, contracts, invoices,accounting records and other business information may be retained for periodsnecessary to satisfy operational, statutory and contractual requirements.

Compliance Platform records

Information entered into the CompliancePlatform is retained in accordance with the relevant service arrangements,processing purposes and applicable legal requirements.

Retention of client-controlled records mayalso be governed by the instructions of the relevant client firm.

Deletion

Where information is no longer required, itwill be securely deleted, anonymised or otherwise disposed of in accordancewith applicable procedures.

Deletion from active working systems may notresult in immediate removal from all encrypted backups or third-party systems,which may be subject to separate retention and deletion cycles.

15. Cookiesand website technologies

Our websites and Compliance Platform may usecookies and similar technologies to support functionality, security and userexperience.

These may include:

• Essential cookies required for website and platform operation;
• Authentication and security cookies;
• Functional cookies that remember preferences;
• Analytics or performance cookies where implemented.

Where consent is required for non-essentialcookies, appropriate information and consent mechanisms will be provided.

Users may also be able to manage cookiesettings through their browsers or any available cookie preference controls.

16.Marketing communications

Rockstone may contact clients and businesscontacts with relevant information about regulatory developments, training,compliance updates and services.

We will comply with applicable UK dataprotection and electronic marketing requirements.

Where consent is required, we will obtain itbefore sending marketing communications.

Where permitted by law, we may rely onlegitimate interests or another appropriate basis for relevantbusiness-to-business communications.

Individuals may opt out of marketingcommunications at any time by contacting us or using an unsubscribe facilitywhere provided.

This does not prevent us from sendingessential service, contractual or administrative communications.

17. Yourdata protection rights

Subject to applicable conditions andexemptions, individuals have rights under UK data protection legislation,including:

Right of access: To request access to personal information held about them.

Right to rectification: To request correction of inaccurate or incomplete information.

Right to erasure: To request deletion of personal information where the relevant legalconditions are met.

Right to restrict processing: To request limitations on certain processing activities.

Right to object: To object to processing in specified circumstances, including anabsolute right to object to processing for direct marketing purposes.

Right to data portability: To request the transfer of qualifying personal information in anappropriate format.

Rights relating to automated decision-making: To exercise applicable rights and safeguards relating to qualifyingautomated decisions.

Right to withdraw consent: Where processing is based on consent, to withdraw that consent at anytime.

These rights are not absolute and may besubject to statutory exemptions.

To exercise your rights, please contact:

Elizabeth Harris
Email: elizabeth.harris@rockstonecompliance.co.uk
Telephone: 0333 444 3103

We will respond without undue delay andnormally within one calendar month of receiving a valid request.

Where permitted by law, this period may beextended by a further two months where a request is complex or numerous. Wewill notify you where an extension applies.

Where Rockstone acts solely as a dataprocessor, requests relating to customer information held on behalf of a clientfirm may need to be directed to the relevant firm as data controller.

Rockstone will provide appropriate assistancein accordance with its legal and contractual obligations.

18. Dataprotection complaints

If you have concerns about how Rockstone hascollected, used, stored or protected your personal information, please contactus.

Data Protection Contact: Elizabeth Harris

Email: elizabeth.harris@rockstonecompliance.co.uk

Telephone: 0333 4443103

We will review complaints relating to ourhandling of personal information and respond in accordance with applicablelegal requirements, normally without undue delay and within one month ofreceipt.

Where appropriate, we will explain ourfindings and any action taken.

If you remain dissatisfied, you have the rightto complain to the Information Commissioner's Office (ICO).

Information Commissioner's Office

Website: https://ico.org.uk

Telephone: 0303 123 1113

19.Third-party websites and services

Our websites and Compliance Platform maycontain links to external websites or third-party services.

Rockstone is not responsible for the privacypractices of independent third-party websites.

We encourage individuals to review therelevant privacy information before submitting personal information to externalorganisations.

20. Changesto this Privacy Notice

We may amend this Privacy Notice periodicallyto reflect changes in legislation, regulatory guidance, our services,technology providers or data processing arrangements.

The latest version will be made availablethrough our website and, where appropriate, our Compliance Platform.

Where changes materially affect the processingof personal information, we will take appropriate steps to notify affectedindividuals where required.

Last updated: 12 October 2026

Rockstone Compliance Limited
Registered Company Number: 09905181
www.rockstonecompliance.co.uk
info@rockstonecompliance.co.uk
0333 444 3103

‍