Legal

GDPR Compliance

TakeNote's commitment to UK GDPR and data protection compliance

Our Commitment to Data Protection

TakeNote Ltd ("TakeNote", "we", "us") is committed to protecting the personal data of our clients, their customers, and all individuals whose data is processed through our platform. We comply fully with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

As a platform that processes recorded client meetings for FCA-regulated financial advisory firms, we recognise that we handle particularly sensitive personal data. Our approach to data protection reflects this responsibility — privacy and security are embedded into the design of our platform, not added as an afterthought.

Our Role Under the UK GDPR

When an advisory firm uses TakeNote to record, transcribe, and summarise client meetings, the firm acts as the Data Controller — it determines why and how personal data is processed. TakeNote acts as a Data Processor — we process personal data on behalf of the firm, strictly in accordance with their documented instructions.

We do not determine the purposes of processing. We do not use client data for our own commercial purposes. We process data solely to deliver the services our clients have engaged us to provide.

A formal Data Processing Agreement (DPA) is available to all clients and is executed prior to the commencement of any data processing. The DPA sets out the scope, nature, and purpose of processing, the categories of personal data involved, and the technical and organisational measures we implement to protect that data.

Lawful Basis for Processing

TakeNote processes personal data on behalf of our clients under the following lawful bases:

Contractual Necessity (Article 6(1)(b))

Processing is necessary for the performance of the contract between TakeNote and the advisory firm for the provision of meeting transcription, summarisation, and compliance documentation services.

Legitimate Interests (Article 6(1)(f))

Where applicable, processing may be carried out in pursuit of the legitimate interests of the advisory firm in maintaining accurate client records, evidencing regulatory compliance, and fulfilling obligations under FCA rules and MiFID II.

Consent (Article 6(1)(a))

Where the advisory firm relies on consent as the lawful basis for recording client meetings, TakeNote supports this by providing transparency mechanisms and consent management features within the platform.

The advisory firm, as Data Controller, is responsible for determining and communicating the appropriate lawful basis to its clients and meeting participants. TakeNote provides guidance and documentation to support this.

What Personal Data We Process

In the course of providing our services, TakeNote may process the following categories of personal data on behalf of the advisory firm:

Meeting Participant Data

Names, roles, and voice recordings of individuals participating in recorded meetings, including financial advisers, clients, and any third parties present such as a spouse, accountant, or solicitor.

Transcribed Content

The full text of transcribed conversations, which may include financial circumstances, investment objectives, health information relevant to capacity or vulnerability assessments, employment details, family circumstances, and attitudes to risk.

Meeting Metadata

Dates, times, durations, meeting platform used, and attendee information.

Compliance Documentation

Structured suitability summaries including risk profiles, capacity for loss assessments, vulnerable customer indicators, advice given, action items, and next review dates.

Account and Usage Data

Names, email addresses, and role information of authorised users within the advisory firm, together with access logs and usage data necessary for security and audit purposes.

We do not process personal data beyond what is necessary to deliver the contracted services.

Special Category Data

Recorded client meetings may incidentally contain special category data as defined under Article 9 of the UK GDPR — for example, where a client discloses health information relevant to a capacity for loss assessment or vulnerability indicator.

TakeNote does not actively seek to collect special category data. Where such data is present within meeting recordings or transcriptions, it is processed in accordance with Article 9(2)(a) (explicit consent, where the advisory firm has obtained this from the client) or Article 9(2)(f) (establishment, exercise, or defence of legal claims).

The advisory firm, as Data Controller, is responsible for ensuring that an appropriate lawful basis exists for the processing of any special category data.

UK Data Residency

All personal data processed by TakeNote is stored and processed exclusively within the United Kingdom. Our infrastructure is hosted on Microsoft Azure UK South.

Client meeting recordings, transcriptions, summaries, metadata, and all associated personal data never leave the United Kingdom. We do not use sub-processors located outside the UK for any processing activity that involves client data.

This commitment to UK data residency is contractually guaranteed in our Data Processing Agreement and is a core design principle of the TakeNote platform.

Data Retention

TakeNote retains client data in accordance with the retention period specified by the advisory firm. The default retention period is five years from the date of each meeting, in accordance with MiFID II record-keeping requirements (Article 16(7) of MiFID II as retained in UK law).

All retained records are stored with immutable timestamps and a complete audit trail, ensuring their integrity for regulatory purposes throughout the retention period.

Upon expiry of the retention period, or upon the advisory firm's written request (subject to applicable regulatory retention obligations), personal data is securely deleted using industry-standard methods that render the data irrecoverable. Written confirmation of deletion is provided within 30 days.

Data Subject Rights

Individuals whose personal data is processed through the TakeNote platform have the following rights under the UK GDPR:

Right of Access (Article 15)

The right to obtain confirmation of whether personal data is being processed and, if so, to access that data together with supplementary information about the processing.

Right to Rectification (Article 16)

The right to have inaccurate personal data corrected without undue delay.

Right to Erasure (Article 17)

The right to have personal data deleted in certain circumstances, subject to applicable regulatory retention requirements. Where MiFID II retention obligations apply, erasure may be deferred until the expiry of the mandatory retention period.

Right to Restriction of Processing (Article 18)

The right to restrict the processing of personal data in certain circumstances.

Right to Data Portability (Article 20)

The right to receive personal data in a structured, commonly used, machine-readable format.

Right to Object (Article 21)

The right to object to the processing of personal data in certain circumstances.

As a Data Processor, TakeNote does not respond directly to data subject requests. All requests should be directed to the advisory firm in the first instance. TakeNote will provide the advisory firm with all necessary technical assistance to fulfil data subject requests promptly and within the timeframes required by the UK GDPR.

Security Measures

TakeNote implements comprehensive technical and organisational measures to protect personal data, including:

Encryption

All data is encrypted at rest using AES-256 encryption and in transit using TLS 1.3. Encryption keys are managed through Azure Key Vault with automatic key rotation.

Access Controls

Role-based access controls ensure that advisers can only access their own meeting records, while compliance officers have appropriate firm-wide visibility. Multi-factor authentication is enforced for all user accounts.

Audit Logging

All access to personal data is recorded with immutable audit logs capturing user identity, action performed, timestamp, and IP address.

Penetration Testing

Annual penetration testing is conducted by an independent CREST-accredited firm. Results and remediation reports are available to clients under NDA.

Personnel Security

All TakeNote personnel with access to client data are subject to background checks, binding confidentiality obligations, and mandatory data protection training.

Certifications

TakeNote is SOC 2 Type II certified and Cyber Essentials Plus certified. ISO 27001 certification is in progress.

Full details of our security measures are set out in Schedule 2 of our Data Processing Agreement, available on request.

Data Protection Impact Assessment

TakeNote has conducted a Data Protection Impact Assessment (DPIA) in respect of the processing activities carried out through our platform, in accordance with Article 35 of the UK GDPR. The DPIA addresses the nature, scope, context, and purposes of the processing, the risks to the rights and freedoms of data subjects, and the measures implemented to mitigate those risks.

A summary of the DPIA is available to clients and prospective clients on request to support their own data protection compliance obligations.

Sub-processors

TakeNote engages a limited number of sub-processors to deliver its services. All sub-processors are contractually bound by data protection obligations no less onerous than those set out in our Data Processing Agreement.

Our current sub-processors are disclosed in Schedule 3 of the Data Processing Agreement. Clients are notified at least 30 days in advance of any proposed changes to sub-processors, with the right to object on reasonable grounds.

No sub-processor processes client data outside the United Kingdom.

No Training on Client Data

TakeNote does not use client data — including meeting recordings, transcriptions, summaries, or any associated personal data — to train, fine-tune, or improve artificial intelligence or machine learning models.

This commitment is contractually guaranteed in our Data Processing Agreement.

Client data is processed solely for the purpose of delivering the contracted services to the advisory firm. It is never aggregated, anonymised for secondary use, or shared with any third party for model development purposes.

International Data Transfers

TakeNote does not transfer personal data outside the United Kingdom. All processing, storage, and backup of client data takes place exclusively within Microsoft Azure UK South.

In the exceptional circumstance that a transfer outside the UK were to become necessary, TakeNote would obtain the prior written consent of the advisory firm and implement appropriate safeguards in accordance with Chapter V of the UK GDPR, including the International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses as applicable.

Breach Notification

In the event of a personal data breach affecting client data, TakeNote will notify the advisory firm without undue delay and in any event within 24 hours of becoming aware of the breach. The notification will include a description of the nature of the breach, the likely consequences, and the measures taken or proposed to address it.

TakeNote maintains a documented incident response procedure and conducts regular breach response exercises to ensure readiness.

Contact

For questions about our data protection practices, to request a copy of our Data Processing Agreement or DPIA summary, or to raise any data protection concern, please contact:

Data Protection Officer

TakeNote Ltd

7 Bell Yard

London WC2A 2JR

Email: dpo@takenote.ai