Privacy Policy

Effective Date: 10 May 2026

1. Introduction

crystal-api Limited ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website or use our services.

2. Information We Collect

2.1 Information You Provide

We collect information you voluntarily provide when you:

Request a consultation or assessment
Become a client
Contact us via email or contact forms
Subscribe to our communications

This may include your name, email address, postal address, date of birth, financial information, pension details, and any other information relevant to providing financial advice.

2.2 Automatically Collected Information

When you visit our website, we may automatically collect certain information about your device, including:

IP address
Browser type and version
Operating system
Pages visited and time spent on pages
Referring website addresses

3. How We Use Your Information

We use the information we collect to:

Provide pension and retirement planning advisory services
Respond to your inquiries and requests
Conduct financial analysis and modeling
Comply with legal and regulatory obligations
Improve our website and services
Send you relevant updates and communications (with your consent)
Prevent fraud and maintain security

4. Legal Basis for Processing

Under UK GDPR, we process your personal data based on:

Consent: You have given clear consent for us to process your personal data for specific purposes
Contract: Processing is necessary for a contract we have with you
Legal obligation: Processing is necessary for us to comply with legal requirements (e.g., Financial Conduct Authority regulations)
Legitimate interests: Processing is in our legitimate business interests, provided it does not override your rights

5. Information Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information with:

Service Providers: Third-party companies that help us operate our business (e.g., IT support, document storage)
Pension Providers: When necessary to implement your retirement strategy
Professional Advisors: Solicitors, accountants, or other professionals involved in your financial planning
Regulatory Authorities: When required by law or regulation

All third parties are required to maintain the confidentiality of your information and use it only for the purposes we specify.

6. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

Encrypted data transmission (SSL/TLS)
Secure servers and databases
Access controls and authentication
Regular security assessments
Staff training on data protection

7. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required by law. Financial services regulations typically require us to retain client records for at least six years after the end of our professional relationship.

8. Your Rights

Under UK GDPR, you have the following rights:

Right of access: Request a copy of the personal data we hold about you
Right to rectification: Request correction of inaccurate or incomplete data
Right to erasure: Request deletion of your personal data (subject to legal obligations)
Right to restriction: Request limitation on how we use your data
Right to data portability: Receive your data in a structured, commonly used format
Right to object: Object to processing based on legitimate interests
Right to withdraw consent: Withdraw consent at any time (where consent is the legal basis)

To exercise any of these rights, please contact us at [email protected].

9. Cookies

We use cookies and similar tracking technologies to enhance your browsing experience. For detailed information about the cookies we use and your choices, please see our Cookies Policy.

10. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of these external sites. We encourage you to review their privacy policies before providing any personal information.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The updated version will be indicated by an updated "Effective Date" at the top of this policy. We encourage you to review this page periodically.

12. Contact Information

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

crystal-api Limited
14 Threadneedle Street
London EC2R 8AY
United Kingdom
Email: [email protected]

13. Regulatory Authority

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Tel: 0303 123 1113
Website: www.crystal-api.com