Privacy Policy

Last updated: 1 June 2025 • Workthru Ltd • Glasgow, Scotland

1. Who we are

Intake is a product of Workthru Ltd, a company registered in Scotland. Our registered address is available on request. You can contact us at intake@workthru.co.uk.

For the purposes of data protection law, Workthru Ltd is the data controller for information relating to our business contacts and website visitors, and a data processor for personal data processed on behalf of financial adviser firms (our customers) using the Intake platform.

2. Data we collect and why

2.1 Website visitors (intake.workthru.co.uk)

Data	Purpose	Legal basis
IP address, browser type, pages visited	Analytics, security	Legitimate interests
Name and email (if you contact us)	Responding to enquiries	Legitimate interests / consent
Name and email (if you book a demo)	Sales and onboarding	Contractual necessity / consent

2.2 Intake platform users (financial adviser firms)

When financial adviser firms use Intake to onboard their clients, the following data is processed:

Data category	Examples	Purpose
Client personal data	Name, date of birth, address, NI number, email	Completing onboarding forms on behalf of the adviser firm
Financial data	Income, assets, investment objectives	Suitability and regulatory compliance
Compliance data	Source of wealth, KYC/AML information, PEP status	FCA regulatory requirements
Meeting transcripts	Adviser-client meeting recordings and transcripts	AI-assisted form pre-population (with adviser consent)
Usage data	Form completion events, timestamps	Audit trail, product improvement

This data is processed on behalf of the adviser firm, who is the data controller for their clients' personal data. The adviser firm is responsible for ensuring they have a lawful basis to collect and share this data with Intake.

3. How we store and protect your data

All data is stored on Supabase infrastructure hosted within the European Economic Area. We apply the following security measures:

• Encryption at rest and in transit (TLS 1.2+)
• Row-level security policies ensuring firm data isolation
• Access controls limiting staff access to production data
• Immutable audit logs for all data access and modification events
• Regular security reviews and dependency updates

We are in the process of obtaining Cyber Essentials certification. We do not transfer data outside the UK or EEA without appropriate safeguards.

4. Data sharing

We do not sell personal data. We share data only with:

• Supabase Inc. — our database infrastructure provider, under a Data Processing Agreement
• Anthropic PBC — when AI transcript extraction is used, transcript content is processed via the Anthropic API. No personal data is retained by Anthropic after processing.
• Vercel Inc. — our website hosting provider
• Law enforcement or regulatory bodies, where required by law

5. Data retention

We retain personal data for as long as necessary to provide the service and comply with legal obligations:

• Active client records: retained for the duration of the adviser firm's subscription plus 7 years (to meet FCA record-keeping requirements)
• Completed form submissions: retained for 7 years from completion date
• Meeting transcripts: retained for 90 days after extraction, then deleted
• Website enquiries: retained for 2 years

Adviser firms may request deletion of their client data at any time, subject to legal retention requirements.

6. Your rights

Under UK GDPR, individuals whose data we process have the following rights:

• Right of access — request a copy of your personal data
• Right to rectification — request correction of inaccurate data
• Right to erasure — request deletion of your data (subject to legal obligations)
• Right to restrict processing — request we limit how we use your data
• Right to data portability — receive your data in a machine-readable format
• Right to object — object to processing based on legitimate interests

If you are a client of a financial adviser firm using Intake, please contact your adviser in the first instance, as they are the data controller for your personal data.

To exercise your rights directly with Workthru, contact us at intake@workthru.co.uk. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

7. Cookies

The Intake marketing website uses minimal cookies. See our Cookie Policy for details.

8. Changes to this policy

We may update this policy from time to time. Material changes will be notified to registered users by email. The date at the top of this page reflects the most recent update.

9. Contact

For any privacy-related queries: intake@workthru.co.uk
Workthru Ltd, Glasgow, Scotland