Last updated: June 19, 2026
cobalt-plateau is fully committed to compliance with the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018. This page outlines our approach to data protection and your rights under these regulations.
We take our data protection responsibilities seriously and have implemented comprehensive measures to ensure compliance with GDPR principles:
We process personal data under the following legal bases as defined by GDPR:
When you engage our services, we process your personal data to fulfill our contractual obligations to you. This includes providing the financial consultation services you've requested and communicating with you about your appointments.
We may process certain data based on our legitimate business interests, such as improving our services, maintaining security, and conducting business analytics. We always balance these interests against your rights and freedoms.
We process personal data when required to comply with legal obligations, including financial record-keeping requirements and responding to lawful requests from authorities.
For certain processing activities, we rely on your explicit consent. You have the right to withdraw this consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
You have extensive rights regarding your personal data under GDPR. These rights are free to exercise and we will respond within one month of your request.
You have the right to obtain confirmation that we are processing your personal data and to receive a copy of that data. You can also request information about how we process your data, why we process it, who we share it with, and how long we retain it.
If your personal data is inaccurate or incomplete, you have the right to have it corrected or completed without undue delay.
Also known as the "right to be forgotten," this allows you to request deletion of your personal data in certain circumstances, including when the data is no longer necessary for the purpose it was collected, when you withdraw consent, or when you object to processing.
You can request that we limit the processing of your personal data in certain situations, such as when you contest the accuracy of the data or object to processing.
You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller where technically feasible.
You can object to processing of your personal data based on legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
You have the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal effects or similarly significantly affect you. We do not engage in automated decision-making that significantly affects our clients.
To exercise any of your GDPR rights, please contact us:
When submitting a request, please provide:
We will respond to your request within one month. In complex cases, we may extend this period by two additional months and will inform you of any such extension.
In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR.
While we are not legally required to appoint a Data Protection Officer, we have designated a data protection contact who oversees our GDPR compliance efforts. You can reach this contact through [email protected].
Your personal data is primarily stored and processed within the United Kingdom. If we need to transfer data internationally, we ensure appropriate safeguards are in place, such as:
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected or as required by law. Our standard retention periods are:
We do not knowingly process personal data of individuals under 18 years of age. Our services are directed to adults only. If we become aware that we have inadvertently collected data from a child, we will take immediate steps to delete that information.
If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with a supervisory authority. In the United Kingdom, this is the Information Commissioner's Office (ICO):
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Phone: 0303 123 1113
Website: www.ico.org.uk
However, we encourage you to contact us first so we can address your concerns directly.
We may update this GDPR compliance statement periodically to reflect changes in our practices or legal requirements. Material changes will be communicated through our website with an updated "Last updated" date.
For any questions about our GDPR compliance or data protection practices, please contact us:
Email: [email protected]
Address: 45 Deansgate, Manchester, M3 2AY, United Kingdom