Complaints Procedure

Last updated: November 2026. This procedure is provided as a starting point and should be reviewed before publication.

Your Rights Under UK GDPR

Right to be Informed – You have the right to be informed about the collection and use of your personal data.

Right of Access – You have the right to access and receive a copy of your personal data and other supplementary information.

Right to Rectification – You have the right to have inaccurate personal data rectified, or completed if it is incomplete.

Right to Erasure – You have the right to have personal data erased.

Right to restrict processing – You have the right to restriction or suppression of your personal data.

Right to data portability – You can request a copy of data and/or to reuse this data for your own purposes across different services.

Rights relating to automated decision making including profiling – You have specific rights when automated decisions are made about you or you are profiled as part of a service. More information on this right can be sought through our compliance team.

To exercise these rights, contact us using the details provided below or email grahambrooke@thinkpositive.co.uk.

We will respond within 1 calendar month unless the request is particularly complex, in which case an extension with a maximum time of 3 calendar months may be requested. You will be informed of any extension or issues in resolving your request.

To access your personal information

You can ask us to confirm whether or not we have and are using your personal data. You can also ask to get a copy of your personal data from us and for information on how we process it.

To rectify or erase your personal information

You can ask that we rectify any information about you which is incorrect. We will be happy to rectify such information but would need to verify the accuracy of the information first.

You can ask that we erase your personal data if you think we no longer need to use it for the purpose we collected it from you.

You can also ask that we erase your personal data if you have either withdrawn your consent to us using your information (if we originally asked for your consent to use your information), or exercised your right to object to further legitimate use of your information, or where we have used it unlawfully or where we are subject to a legal obligation to erase your personal data.

We may not always be able to comply with your request, for example where we need to keep using your personal data in order to comply with our legal obligation or where we need to use it to establish, exercise or defend legal claims.

To restrict or object to how we use your personal information

You can ask that we restrict our use of your personal data in certain circumstances, for example:

• where you think the information is inaccurate and we need to verify it;
• where our use of your personal data is not lawful but you do not want us to erase it;
• where the information is no longer required for the purposes for which it was collected but we need it to establish, exercise or defend legal claims; or
• where you have objected to our use of your personal data but we still need to verify if we have overriding grounds to use it.

We can continue to use your personal data following a request for restriction where we have your consent to use it; or we need to use it to establish, exercise or defend legal claims, or we need to use it to protect the rights of another individual or a company.

To request a transfer of personal information

You can ask us to provide your personal data to you in a structured, commonly used, machine-readable format, or you can ask to have it transferred directly to another data controller (e.g. another company).

You may only exercise this right where we use your personal data in order to perform a contract with you, or where we asked for your consent to use your personal data. This right does not apply to any personal data which we hold or process outside automated means.

Automated decision making and profiling

If we made a decision about you based solely by automated means (i.e. with no human intervention), and the decision made by us produces a legal effect concerning you, or significantly affects you, you may have the right to contest that decision, express your point of view and ask for a human review. These rights do not apply where we are authorised by law to make such decisions and have adopted suitable safeguards in our decision making processes to protect your rights and freedoms.

To obtain a copy of our safety measures for transfers outside of Europe

You can ask for a copy of, or reference to, the safeguards we have put in place when your personal data is transferred outside of the European Economic Area. We are not required to share details of these safeguards where sharing such details would affect our commercial position or create a security risk.

Data anonymization and aggregation

Your personal data may be converted into statistical or aggregated data which cannot be used to identify you, then used to produce statistical research and reports.

How to contact us

You can contact us for more information. If you are not satisfied with the level of information provided in this privacy notice, you can ask us about what personal data we have about you, what we use your information for, who we disclose your information to, whether we transfer it abroad, how we protect it, how long we keep it for, what rights you have, how you can make a complaint, where we got your data from and whether we have carried out any automated decision making using your personal data.

If you would like to exercise any of the above rights, please:

• Email or write to us at grahambrooke@thinkpositive.co.uk or call 07774 744150;
• Provide us with enough information to identify you, e.g. name, address, date of birth;
• Provide proof of your identity and address (a copy of your driving licence or passport and a recent utility or credit card bill); and
• Let us know the information to which your request relates.

The supervisory authority (ICO)

We ask that you please attempt to resolve any issues with us before reporting to the ICO.

If you are not happy with the way we deal with any complaints or have any further concerns, you have the right to lodge a complaint with the UK's data protection regulator, the Information Commissioner's Office (ICO), who can be contacted through their website at https://ico.org.uk/global/contact-us or by writing to:

The Financial Ombudsman Service

If you're dissatisfied with our response, you can ask the Financial Ombudsman Service for an independent review free of charge, but you must do so within six months of the date of the final response letter.

The Financial Ombudsman Service (FOS) will only consider your complaint once you've tried to resolve it with us, so please take up your concerns with us first and we'll do all we can to help.

The FOS is also only able to consider certain categories of complaint. For example, complaints about Buy to Let mortgages, which are not regulated by the Financial Conduct Authority, will normally be outside the jurisdiction of the FOS.

In addition, the FOS might not be able to consider your complaint if:

• What you're complaining about happened more than six years ago, and
• You're complaining more than three years after you realised (or should have realised) that there was a problem.

If your complaint was made outside of these time limits, which is a matter for The Ombudsman to decide, The Ombudsman will not have our permission to consider your complaint and so will only be able to do so in very limited circumstances.

Further information on the services provided by the Financial Ombudsman Service can be found on their website: www.financial-ombudsman.org.uk

Post: The Financial Ombudsman Service, Exchange Tower, London, E14 9SR
Phone: 0800 023 4567 or 0300 123 9123
Email: complaint.info@financial-ombudsman.org.uk