Privacy policy
Last updated: 22 October 2026
Privacy notice
Executive Life Limited Version 2.1 · Last updated: 22 October 2026 · Next review: October 2027
This notice explains how Executive Life Limited collects, uses, shares and protects personal data when you visit our websites, ask us for a quote, speak to us, become a client, or are named in an application or policy we arrange. It also explains your rights and how to complain. It is written to meet the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended by the Data (Use and Access) Act 2025.
1. Who we are
Executive Life Limited is the controller of your personal data. This means we decide how and why it is used.
| Item | Details |
|---|---|
| Legal name | Executive Life Limited |
| Company number | 13876417 (registered in England and Wales) |
| Registered office | Unit 6 Birchy Cross Business Centre, Broad Lane, Tanworth-in-Arden, Solihull, England, B94 5DN |
| Data protection registration | Registered with the Information Commissioner's Office (ICO) under number ZB592564 |
| Regulatory status | Executive Life Limited is authorised and regulated by the Financial Conduct Authority (FRN 985058). You can check our details on the FCA Register (https://register.fca.org.uk/). |
| Trading names and websites | Executive Life and Relevant Life. This notice covers executive-life.co.uk, relevantlife-insurance.co.uk, relevantlife.executive-life.co.uk and life.executive-life.co.uk |
We are an insurance intermediary. We advise on and arrange business protection and life insurance, for example relevant life insurance, executive income protection, key person insurance, shareholder protection, business life insurance and business health insurance. We do not provide the insurance ourselves. The insurer that provides your policy makes its own decisions and is a separate controller of your personal data (see section 13).
2. How to contact us about your personal data
| Item | Details |
|---|---|
| Data Protection Officer | Our Data Protection Officer can be contacted using the details below |
| hello@executive-life.co.uk (please put "Data protection" in the subject line) | |
| Phone | 020 4540 6009 |
| Post | Data Protection Officer, Executive Life Limited, Unit 6 Birchy Cross Business Centre, Broad Lane, Tanworth-in-Arden, Solihull, B94 5DN |
Please use these details for any request, question or complaint about your personal data. Our previous privacy policy gave an email address that belongs to another business. Please do not use it. If you sent a request to that address and have not had a reply, please contact us again using the details above.
3. Summary
- We use your information to answer your enquiry, advise you, arrange and look after insurance, meet our legal and regulatory duties, and run our business.
- Insurance applications usually need health and lifestyle information. We ask for your explicit consent to collect it, and we protect it carefully (section 8).
- We record all phone calls and use AI tools to transcribe and take notes of calls. We tell you about this at the start of each call (sections 5 and 9).
- We share your information with the insurers we approach for you, our compliance support firm and the service providers who help us run our business. We do not sell your personal data.
- We do not make decisions about you that have legal or similarly significant effects using only automated means. Our advisers make the recommendations. Insurers make their own underwriting decisions (section 10).
- Analytics and advertising cookies only run if you agree. You can change your choices at any time using the Cookie settings link in our website footer (section 11).
- You have rights over your data, including access, correction, erasure and objection. You can complain to us and, if you are not satisfied, to the ICO (sections 18 and 19).
4. Whose data this notice covers
- Website visitors, including people who use our quote forms or booking links.
- Enquirers and prospective clients, and people who call, email or book a call with us.
- Clients: individual policyholders, and the directors, owners and staff who act for a business client.
- People named in an application or policy, such as lives assured, insured persons, key people, co-directors, shareholders, employees covered by a business policy, beneficiaries and trustees.
- Introducers and professional contacts, such as accountants, solicitors and other professional advisers who refer clients to us or work with us.
- People who make a complaint or a data protection request.
If you give us information about someone else (for example, a business naming a key person, or a director naming a co-director), please make sure they know you are doing so and point them to this notice. Where we receive data about a person from someone else, we will give them this information within a reasonable period, and at the latest within one month or when we first contact them, unless an exemption applies.
5. The personal data we collect
| Category | Examples |
|---|---|
| Identity and contact details | Name, title, date of birth, email address, phone number, postal address |
| Quote request details (from our website forms) | First and last name, email, phone, date of birth, amount of cover required (arrange-a-quote form) or annual income band (executive income protection form), and whether you smoke |
| Business and employment details | Company name and details, role, shareholding, salary and dividends, and business finances relevant to the cover |
| Financial details | Income, existing policies and premiums, and cover amounts |
| Health and lifestyle information (special category data) | Smoker status, medical history, height and weight, medication, family medical history, alcohol use, occupation risks, pastimes, and medical reports or screening results requested by an insurer |
| Policy and claims information | Applications, quotes, underwriting outcomes, policy numbers, renewals, claims information and related correspondence |
| Calls and communications | Emails and letters. Recordings of all phone calls with us. AI-generated transcripts, notes and summaries of calls. Notes of meetings |
| Marketing preferences | Whether you have agreed to, or opted out of, marketing emails |
| Website and device data | IP address, device and browser information, pages visited, referring site, and identifiers set by cookies and similar technologies (section 11) |
| Lead source information | When you submit a quote form, hidden fields record how you found us. These include the advertising source, campaign, ad group, keyword, ad click identifier (for example a Google "GCLID"), landing page, referring page, first source, first visit date and number of visits before your enquiry |
| Complaint and rights request records | Details of your complaint or request and how we handled it |
6. Where we get your personal data
- From you, through our website forms, by phone, email, video call, booking tools or in meetings.
- From your business, a fellow director or shareholder, or your employer, when they ask us to arrange cover that relates to you (for example relevant life, key person, shareholder protection or executive income protection).
- From introducers, such as your accountant, solicitor or another professional adviser, where they refer you to us.
- From insurers and their underwriters, including quotes, underwriting decisions, medical evidence requirements and policy information.
- From medical professionals and screening providers, where an insurer asks for a report and you have given the consent the insurer needs.
- From Iress Exchange, the quote comparison platform we use to compare products and prices from insurers.
- From public sources, such as Companies House.
- From our website, through cookies and similar technologies, and from advertising platforms that tell us which advert or search led to your enquiry (section 11).
7. Why we use your data and our lawful bases
We must have a lawful basis under UK GDPR Article 6 for each use. Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for details of this balancing test.
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Responding to your enquiry or quote request, and preparing quotes | Steps at your request before entering into a contract (Art 6(1)(b)) where you will be the policyholder or our client. Legitimate interests (Art 6(1)(f)) where the client is your business or someone else has named you: our interest in responding to enquiries and advising businesses on protection |
| Advising you, comparing products (including through Iress Exchange) and arranging cover with insurers (applications, underwriting, policy set-up) | Contract (Art 6(1)(b)) with you as our client, or legitimate interests (Art 6(1)(f)) where we act for your business or you are a named life assured, key person, beneficiary or trustee |
| Looking after your policy: reviews, renewals, changes and help with claims | Contract (Art 6(1)(b)) or legitimate interests (Art 6(1)(f)) in providing an ongoing service |
| Recording all calls, and transcribing and summarising them with AI tools, so that we have an accurate record of what was discussed and the advice given, and for quality and training | Legitimate interests (Art 6(1)(f)) in keeping accurate records of advice, meeting our regulatory obligations and improving our service. Health information discussed on calls is covered by section 8 |
| Keeping records of our advice and the business we arrange, regulatory reporting, external compliance checks of our files, and dealing with the FCA, the Financial Ombudsman Service and HMRC | Legal obligation (Art 6(1)(c)), including FCA record-keeping rules, and legitimate interests (Art 6(1)(f)) in having our advice independently checked |
| Handling complaints (about our service or about your data) and data protection requests | Legal obligation (Art 6(1)(c)) |
| Sending marketing emails about our services to existing clients | Legitimate interests (Art 6(1)(f)) in promoting similar services to our clients. You can opt out at any time (section 12) |
| Sending marketing emails to people who sign up to receive them | Consent (Art 6(1)(a)). You can withdraw it at any time (section 12) |
| Website security, including bot protection on our forms | Legitimate interests (Art 6(1)(f)) in keeping our website and forms secure |
| Website analytics (Google Analytics, Ahrefs Web Analytics) and advertising measurement (Google Ads, Microsoft Advertising) | Consent (Art 6(1)(a)), given through our cookie banner (section 11) |
| Using lead source information to understand which adverts and channels bring enquiries | Legitimate interests (Art 6(1)(f)) in measuring and improving our marketing |
| Running our business: IT, email and file storage, administration, insurance, audit, professional advice, and establishing, exercising or defending legal claims | Legitimate interests (Art 6(1)(f)), and legal obligation (Art 6(1)(c)) where applicable |
| Reorganising or selling our business | Legitimate interests (Art 6(1)(f)) in the continuity of client service |
We do not carry out identity, anti-money laundering or fraud checks ourselves. Insurers carry out their own checks (section 13).
We do not rely on the "recognised legitimate interests" basis (UK GDPR Article 6(1)(ea)) for our normal client work. If we ever need to share information for one of the specific purposes it covers, such as detecting or preventing crime, safeguarding a vulnerable person or responding to an emergency, we may rely on it.
8. Health information (special category data)
Arranging protection insurance usually means collecting data concerning health (and occasionally genetic test results, if an insurer asks and the law and industry rules allow it). This is "special category data" under UK GDPR Article 9. It may be collected on our fact-find, in documents you send us, and in conversation on recorded calls.
- Your explicit consent: we ask for your explicit consent (Article 9(2)(a)) on our fact-find before we collect and use your health information to advise you and arrange cover.
- Insurance condition: we also rely on Article 9(2)(g) (substantial public interest), together with the insurance condition in paragraph 20 of Schedule 1 to the Data Protection Act 2018. This allows processing that is necessary for an insurance purpose: advising on, arranging, underwriting or administering an insurance contract, administering a claim, or exercising rights and meeting obligations connected with an insurance contract. We rely on this condition, for example, to keep the records we must keep about a policy we have arranged, or where we hold health information that came up on a call before consent was recorded.
- People who are not party to the policy: where we hold health information about someone who is not, and is not expected to become, a policyholder, insured person or otherwise connected to the contract (for example family medical history), we only rely on the insurance condition where we cannot reasonably be expected to get that person's consent and are not aware of them withholding it.
- Withdrawing consent: you can withdraw your consent at any time by contacting us (section 2). If you do, we will stop using your health information for new purposes that rely on your consent. This is likely to mean that we cannot continue advising you or arranging cover, and the insurer may not be able to offer or continue cover. We may still need to keep some information under the insurance condition or to meet our legal obligations, for example records of advice already given.
- Insurers' consent: insurers, or medical professionals working for them, may ask for your separate explicit consent before obtaining medical reports.
- Our safeguards: we have an appropriate policy document explaining how we comply with the data protection principles for this data and how long we keep it. Access is limited to staff who need it. Please do not include health details in our website quote forms beyond the smoker question. We will collect any further health information securely.
9. How we use artificial intelligence (AI) and call recording
We want to be open about the technology we use.
| Tool | What it does | What it means for you |
|---|---|---|
| Dialpad (phone system) | Records all calls to and from us. Dialpad Ai transcribes calls | Our staff tell you at the start of each call that it is being recorded and transcribed. Recordings are kept for 12 months (section 16). Dialpad does not use our calls to train its AI |
| Airspeed (AI note-taker, provided by Glyphic AI Limited, a UK company) | Joins our client calls and produces a transcript, notes and a summary. Airspeed's call summaries are added to our client records in our CRM | Our staff tell you at the start of the call that an AI note-taker is being used. Airspeed holds data in the UK, Ireland and the USA (section 15) |
| General AI assistants (ChatGPT and Claude) | Help staff with general work such as writing and research | We do not enter client information into these tools. |
| Advertising platforms (Google Ads, Microsoft Advertising) | Use their own automated systems, including machine learning, to decide when to show our adverts and to measure results | Only use advertising cookies if you agree. Google and Microsoft are responsible for their own processing under their own privacy notices |
| Iress Exchange (quote comparison) | Compares insurers' products and prices | It is a comparison tool only. Your adviser reviews the results and makes the recommendation |
Our commitments
- People make the decisions. AI tools help us record, transcribe, summarise and compare. Our advice and recommendations are made by a qualified person at Executive Life, who checks AI-generated notes before relying on them.
- No solely automated significant decisions by us. See section 10.
- Training AI models: we do not use your personal data to train AI models. Dialpad does not use our calls to train its AI. We do not put client information into general AI assistants.
- Risk assessment: we have carried out a data protection impact assessment covering call recording, transcription and our AI note-taker.
- Providers and transfers: our call-recording and note-taking providers process call data on our behalf. Some process data outside the UK (section 15).
- Your rights apply. You can ask us whether AI was used in handling your data, object to particular uses, and use the rights in section 18.
10. Automated decision-making and profiling
Decisions by Executive Life. We do not make decisions about you based solely on automated processing that have a legal or similarly significant effect on you. An adviser is always involved. Iress Exchange compares products and prices, but your adviser decides what to recommend.
Profiling for marketing and website purposes. If you agree to analytics and advertising cookies, our website and advertising tools build a picture of how you use our site and which adverts you saw, for example to measure campaigns and show you our adverts on other sites (section 11). We do not consider this to have a legal or similarly significant effect on you. You can withdraw consent at any time, and you have an absolute right to object to profiling for direct marketing.
Decisions by insurers. Underwriting decisions (whether to offer cover, on what terms and at what price) and claims decisions are made by the insurer, not by us. Some insurers use automated underwriting systems, which can include health information. Where an insurer takes a significant decision about you based solely on automated processing, UK GDPR Articles 22A to 22D apply to the insurer. In particular:
- a significant decision based on health information may only be taken solely by automated means with your explicit consent, or where it is necessary for a contract with you (or required or authorised by law) and a substantial public interest condition applies; and
- the insurer must have safeguards that give you information about the decision and let you make representations, obtain human intervention and contest the decision.
The insurer's privacy notice explains how it does this. We will give you the insurer's details and help you ask the insurer for a human review if you want one.
11. Cookies and similar technologies
Cookies, pixels, local storage and similar technologies store or read information on your device. Under PECR, as amended by the Data (Use and Access) Act 2025, we must ask for your consent unless an exception applies. The exceptions include technologies that are strictly necessary (for example security), and technologies used only to collect statistics to improve our website, provided we give you clear information and a simple, free way to object. Advertising always needs consent.
When you first visit our website, our cookie banner (provided by CookieYes) lets you accept, reject or customise analytics and advertising cookies. You can change your choices at any time using the "Cookie settings" link in the footer of every page.
Strictly necessary (always on)
| Tool and provider | Purpose | What it stores or accesses |
|---|---|---|
| CookieYes | Records your cookie choices | cookieyes-consent cookie |
| Cloudflare and Cloudflare Turnstile | Protects our website and quote forms from bots, spam and abuse | _cfuvid cookie and a Turnstile check when forms load |
| Webflow | Hosts our website and receives form submissions | Website hosting and form processing |
| Google Tag Manager (Google) | Loads our other tags according to your choices. It does not run analytics or advertising tags unless you agree | Container GTM-TRSPCRK |
Analytics (only with your consent)
| Tool and provider | Purpose | What it stores or accesses |
|---|---|---|
| Google Analytics 4 (Google) | Measures visits and how the site is used | _ga, _ga_77DSNT0B3L cookies. Data kept for 14 months |
| Ahrefs Web Analytics (Ahrefs) | Website traffic statistics | Ahrefs says the tool uses no cookies and does not store IP addresses. It reads information sent by your browser (such as IP address, browser type, page and referrer) to produce statistics |
Advertising (only with your consent)
| Tool and provider | Purpose | What it stores or accesses |
|---|---|---|
| Google Ads (Google) | Measures which adverts and calls lead to enquiries and helps show our adverts | _gcl_au and Google advertising (doubleclick.net) cookies |
| Microsoft Advertising UET (Microsoft) | Measures which Bing and Microsoft adverts lead to enquiries and helps show our adverts | _uetsid, _uetvid, MUID cookies |
Third-party pages: if you book a call, you use Calendly's booking page, and Calendly sets its own cookies under its own privacy and cookie notices.
How long each cookie lasts is shown in the cookie banner's settings panel. Our website also loads code and fonts from content delivery networks (for example jsDelivr and Amazon CloudFront). These receive your IP address so that they can deliver files to your browser.
12. Marketing
We send marketing emails from our own client relationship management (CRM) system.
- Existing clients: we may email you about similar services we offer. We give you the chance to opt out when we collect your details and in every message.
- People who sign up: we only email you if you have actively agreed, for example by ticking an (unticked) box on a sign-up form.
You can opt out at any time by using the unsubscribe link in any email or by contacting us (section 2). When you opt out, we add your details to a suppression list so that we do not email you again. You have an absolute right to object to direct marketing, including any profiling related to it.
13. Who we share your data with
We only share what is needed for each purpose.
- Insurers: UK life and protection insurers and underwriters that we approach for quotes or place your cover with, together with their claims teams and the medical and screening providers they appoint.
- Our external compliance support firm, Simply Biz Services Limited (SimplyBiz), which reviews client files to check that our advice meets FCA rules.
- Your business, its accountant, solicitor or other advisers, where you or your business have asked us to work with them, and trustees of any policy trust.
- Introducers (accountants and other professionals) who referred you. We pay introducers a fee for introductions. We may tell an introducer that you have taken out a policy so that their fee can be paid. We do not share any other information with them.
- Service providers who act for us (processors). We require them to keep your data secure and to use it only on our instructions:
| Provider | What they do for us |
|---|---|
| Dialpad | Phone system, call recording and call transcription |
| Airspeed (Glyphic AI Limited) | AI note-taker on client calls |
| Our in-house CRM (hosted on UK cloud servers) | Client records and sending marketing emails |
| Iress Exchange (Iress FS Limited) | Quote comparison platform |
| Google Workspace | Email and document storage, including client emails and documents |
| Microsoft 365 | General business use (not used for client data) |
| Webflow | Website hosting and quote forms |
| Cloudflare | Website security and bot protection |
| CookieYes | Cookie banner and consent records |
| Calendly | Call booking |
| Google (Analytics 4, Tag Manager) and Ahrefs (Web Analytics) | Website analytics, if you consent |
- Advertising platforms (Google Ads and Microsoft Advertising) where you have consented to advertising cookies. These platforms act as separate controllers for their own purposes.
- Professional advisers, auditors and our own insurers.
- Regulators and public bodies, such as the Financial Conduct Authority, the Financial Ombudsman Service, the ICO, HMRC, and the police or courts where the law requires or permits.
- A buyer or successor if we sell or reorganise our business, under confidentiality obligations.
Fraud prevention. We do not search or share data with fraud prevention agencies ourselves. Insurers may check your details with fraud prevention agencies and industry databases, as explained in their privacy notices.
Insurers' own privacy notices. When we pass your details to an insurer, the insurer becomes a separate controller and uses your data under its own privacy notice, including for underwriting, fraud prevention, reinsurance and claims. We will give you, or point you to, the relevant insurer's privacy notice before you apply.
Answering insurers' questions accurately. Under the Consumer Insurance (Disclosure and Representations) Act 2012, if you take out cover as a consumer you must take reasonable care not to make a misrepresentation to the insurer. Different rules can apply to business policies. Inaccurate or incomplete answers can lead an insurer to change or cancel a policy or refuse to pay a claim. We record the information you give us and pass it to the insurer as you provided it.
14. Whether you have to give us your data
You do not have to give us your personal data. However, insurers need complete and accurate information, including health and lifestyle details, to offer cover, and we need certain details to advise you and to meet our legal duties. If you do not provide them, we may not be able to give a quote, advise you or arrange cover. Information needed to meet our legal obligations (for example record-keeping) is a statutory requirement.
15. Sending your information outside the UK
Some of the companies that help us run our business store or access your information outside the UK. When this happens, the law requires us to make sure your information stays protected to a standard that is not materially lower than in the UK. For our suppliers, we rely on one of these protections, except where we explain otherwise below:
- Countries the UK has approved. The UK Government has approved some countries, including those in the European Economic Area (EEA), as protecting personal information properly ("adequacy regulations"). For example, our cookie consent provider, CookieYes, stores consent records in Ireland and Malta.
- The UK-US "data bridge". US companies can sign up to the UK Extension to the EU-US Data Privacy Framework, which the UK Government has approved. We rely on this for Dialpad (our phone and call-recording system), Webflow (our website and online forms), Google (Analytics, Ads, Tag Manager and Workspace), Microsoft (Microsoft 365 and Microsoft Advertising), Cloudflare (website security) and Calendly (call booking). You can check a company's certification at www.dataprivacyframework.gov.
- UK-approved contracts. Where neither of the above applies, we use contracts approved by the UK Information Commissioner: the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU standard contractual clauses. These also act as a back-up if the data bridge stops applying.
Specific suppliers:
- Iress Exchange is hosted in UK data centres. Iress group staff in Australia, Canada, South Africa and Singapore may access it to maintain and support the service. Iress's licence terms require any such transfer to comply with UK data protection law, using standard data protection clauses approved by the ICO or the European Commission where needed. Canada is covered by UK adequacy regulations.
- Ahrefs Web Analytics (provided by Ahrefs Pte Ltd, a Singapore company) only runs if you consent to analytics cookies. The statistics it collects are pseudonymised: it does not use cookies or store IP addresses. The data is stored in Singapore and the USA.
- Airspeed (Glyphic AI Limited) is a UK company. It holds data in the UK, Ireland and the USA. Where Airspeed's processing involves transfers outside the UK, we require them to be protected by UK adequacy regulations or ICO-approved contract terms.
- Google Workspace, which holds our client emails and documents, stores data in Google's data centres, including in the USA. We rely on the UK-US data bridge (Google's certification to the UK Extension), with standard contractual clauses as a back-up. Microsoft 365 is used for general business purposes, not for client data.
- Our CRM is hosted on UK cloud servers. SimplyBiz (Simply Biz Services Limited) is a UK company and handles the information we share with it under UK data protection law, in line with our agreement with it.
If you would like more detail about the protections we use for a particular supplier, or a copy of the relevant safeguard, please contact us (section 2).
16. How long we keep your data
We keep personal data only for as long as we need it for the purposes in this notice, including to meet regulatory record-keeping requirements and to deal with complaints or legal claims.
| Record | How long we keep it |
|---|---|
| Enquiries and quote requests that do not lead to a policy | 24 months after our last contact |
| Website form submissions held in Webflow | Deleted from Webflow 30 days after they are transferred to our CRM |
| Client files: fact-finds, advice and suitability records, applications, policy documents and correspondence, including health information | For the life of the policy plus 6 years |
| Call recordings (Dialpad) | 12 months |
| AI call summaries and notes (Airspeed) | Summaries added to our CRM are kept as part of the client file (life of the policy plus 6 years). Airspeed deletes its own copies in line with our agreement with it |
| Complaints (service and data protection) and rights requests | 6 years after the complaint or request is closed |
| Marketing contacts | Until you unsubscribe. After that, we keep your email address on a suppression list so that we do not contact you again |
| Google Analytics data | 14 months |
| Lead source information attached to enquiries | As for the enquiry or client file it is attached to |
When data is no longer needed, we delete it securely or anonymise it.
17. How we protect your data
We use technical and organisational measures that are appropriate to the risks. These include multi-factor authentication on our systems, encryption of data at rest and in transit, and role-based access so that only staff who need your information can see it. We require our service providers to protect your data. No system is completely secure. If a personal data breach is likely to result in a high risk to you, we will tell you without undue delay. We report breaches to the ICO where the law requires.
18. Your rights
| Right | What it means |
|---|---|
| Access | Get a copy of your personal data and information about how we use it. We will carry out reasonable and proportionate searches |
| Rectification | Have inaccurate data corrected or incomplete data completed |
| Erasure | Have your data deleted in some circumstances. We may need to keep some records to meet legal obligations |
| Restriction | Ask us to limit how we use your data in some circumstances, for example while we check its accuracy |
| Objection | Object to our use of your data where we rely on legitimate interests. You have an absolute right to object to direct marketing, including related profiling |
| Data portability | Receive data you gave us in a structured, machine-readable format, or have it sent to another organisation, where we rely on consent or contract and process it by automated means |
| Withdraw consent | Where we rely on consent (for example for health information, cookies or marketing), withdraw it at any time. This does not affect processing before you withdraw |
| Automated decisions | Where a significant decision is made about you solely by automated means, get information about it, make representations, obtain human intervention and contest it (section 10) |
| Complain | Complain to us (section 19) and to the ICO |
How to use your rights. Contact us using the details in section 2. You do not need to use a particular form. We may need to confirm your identity. We will respond without undue delay and within one month. For complex or numerous requests we may extend this by up to two further months and will tell you why. The time limit starts when we have received any identity information we need. For access requests it may pause if we need to ask you to clarify what you are looking for. We do not normally charge a fee.
19. Complaints
Complain to us first. If you are unhappy with how we have handled your personal data, please tell us so that we can try to put things right. Email hello@executive-life.co.uk with "Data protection complaint" in the subject line. If you cannot use email, you can phone or write to us using the details in section 2.
We will:
- acknowledge your complaint within 30 days of receiving it;
- look into it properly, making the enquiries needed, and keep you updated; and
- tell you the outcome without undue delay.
Complain to the ICO. You also have the right to complain to the Information Commission, still known as the ICO, which is the UK data protection regulator. The ICO recommends that you raise your concern with us first, but you can complain to the ICO at any time.
- Website: https://ico.org.uk/make-a-complaint/
- Helpline: 0303 123 1113
- Post: ICO Head Office, 4th Floor, No.3 Circle Square, 5 Hawkshaw Street, Manchester, M1 7BL
Complaints about our advice or service (rather than your personal data) are handled under our complaints procedure: https://executive-life.co.uk/legal/complaints-procedure. If we cannot resolve those, you may be able to refer them to the Financial Ombudsman Service.
20. Children
Our services and websites are for adults and businesses and are not aimed at anyone under 18. We do not knowingly collect personal data about children.
21. Other websites
Our website links to other sites, such as Calendly for booking calls and our social media pages (LinkedIn, Instagram and Facebook). These sites have their own privacy notices, and we are not responsible for how they use your data.
22. Changes to this notice
We review this notice at least once a year and whenever our processing or the law changes. We will post the updated version on this page with a new "last updated" date and, where changes are significant, tell clients directly.
| Version | Date | Summary |
|---|---|---|
| 1.0 | 29 November 2022 | Previous policy (replaced) |
| 2.0 | 22 October 2026 | Full rewrite for Executive Life Limited. Covers the Data (Use and Access) Act 2025 changes, call recording and AI tools, automated decisions, the cookies in use, data protection complaints, retention and international transfers |