Privacy Policy

Last Updated – March 2026

Introduction

Welcome to Milk and Money Ltd’s (“Milk and Money”, “we”, “us”, “our”) privacy policy.

We take your privacy very seriously. Please read this privacy policy carefully as it contains important information about who we are and how and why we collect, store, use and share your personal data. It also explains your rights in relation to your personal data and how to contact us or supervisory authorities in the event you have a complaint.

Milk and Money Ltd is the data controller and is responsible for your personal data.

Contact details: If you have any questions about this policy or how we handle your data, please contact our data privacy manager at support@milkandmoney.co.uk.

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would appreciate the chance to deal with your concerns before you approach the ICO.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes.

We keep our privacy policy under regular review.

Third-Party Links and Services

This website may include links to third-party websites, plug-ins and applications. Clicking on those may allow third parties to collect or share data about you. We do not control these third-party sites and are not responsible for their privacy statements.

If you use third-party apps, websites or services to access our services (e.g. social media platforms), your usage is subject to their terms, cookies policy, and privacy policy.

The Data We Collect About You

Personal data means any information about an individual from which that person can be identified.

Clients and family members of clients

• Identity Data: includes name.
• Contact Data: includes email address, home address, telephone number.
• Consultation Data: includes income, and other financial information, child(ren)’s month and year of birth, pension contributions and student loan details, advice given pursuant to consultation, contact history.
• Transaction Data: includes details about payments to and from you and other details of products you have purchased from us.

Website users (including clients using online tools)

• Technical Data: includes IP address, browser type and version, pages visited, time and date of visit, time spent on pages, device type, operating system, unique device identifiers, device settings, geo-location data.
• Usage Data: information about how you use our website, IT, communication and other systems.

Important – Online tools/calculators (e.g. tax calculator):

Information you enter is processed locally on your device (in your web browser). We do not collect, store, or process any of the data you input unless you choose to email the results to yourself (in which case we receive a copy of the email). To avoid sharing, screenshot the results instead.

We do not collect Special Categories of Personal Data (e.g. race, religion, health, sexual orientation, genetic/biometric data) or information about criminal convictions.

If You Fail to Provide Personal Data

Where we need personal data by law or under a contract, and you fail to provide it when requested, we may not be able to perform the contract (e.g. provide our services/products). We will notify you if this happens.

How We Collect Your Data

• Directly from you (forms, correspondence, phone, email).
• From third parties (e.g. Google Auth for login – shares basic info like name; payment providers like Stripe).
• Automatically via cookies, server logs, etc. (Technical Data as you interact with the site). See our Cookie Policy.

How We Use Your Personal Data

We only use your personal data when the law allows us to, most commonly:

• To perform a contract with you.
• For our legitimate interests (or a third party’s), where your interests and rights do not override them.
• To comply with a legal obligation.
• In limited cases, with your consent.

Purposes and Lawful Bases

We may process your data for multiple reasons/lawful bases depending on the purpose.

• To register you as a new client and provide services: Identity, Contact, Consultation, Transaction data — Performance of contract + Legitimate interests (to provide services and grow business).
• To manage our relationship (notify changes, ask for reviews): Identity, Contact, Profile — Contract + Legal obligation + Legitimate interests (update records, study product use) + Consent (for reviews).
• To administer/protect business and website (troubleshooting, security, etc.): Identity, Contact, Technical — Legitimate interests (running business, IT/security, fraud prevention) + Legal obligation.
• Data analytics to improve website/products/marketing: Technical, Usage — Legitimate interests (define customer types, update site, develop business, inform marketing).

Cookies

You can set your browser to refuse cookies or alert you when they are used. Disabling cookies may affect site functionality. See our Cookie Policy.

Change of Purpose

We will only use data for the original purposes unless a new compatible purpose arises. If unrelated, we will notify you and explain the legal basis.

We may process data without your knowledge/consent where required/permitted by law.

Disclosures of Your Personal Data

We may share data with:

• Service providers (processors) – payment processing, cloud hosting, IT/system admin.
• Professional advisers (lawyers, bankers, auditors, insurers).
• HM Revenue & Customs, regulators, other UK authorities.
• Third parties in business sale, transfer, merger, or acquisition (new owners would use data per this policy).

Third parties must respect data security and process only per our instructions/not for their own purposes.

International Transfers

We may transfer data outside the UK, but ensure similar protection via:

• Adequacy decisions for the destination country, or
• UK-approved specific contracts.

Contact us for details on mechanisms used.

Data Security

We have appropriate security measures to prevent unauthorised access, loss, use, alteration or disclosure. Access is limited to those with a business need, who process on our instructions and are bound by confidentiality.

Procedures are in place for suspected breaches; we will notify you and regulators where legally required.

Data Retention

We retain personal data only as long as necessary for the purposes collected, including legal, regulatory, tax, accounting or reporting requirements.

Longer retention may apply for complaints or anticipated litigation.

Retention periods consider data amount/nature/sensitivity, risk of harm, purposes, and legal requirements. Contact us for specific periods.

Your Legal Rights

You have rights under data protection laws, including:

• Access: Request a copy of your data and check lawful processing.
• Correction: Have incomplete/inaccurate data corrected (we may verify new data).
• Erasure: Request deletion where no good reason to continue (subject to legal exceptions we will explain).
• Object: To processing based on legitimate interests (or direct marketing). We may continue if compelling grounds override your rights.
• Restrict processing: In certain scenarios (e.g. contesting accuracy, unlawful use but you don’t want erasure, need for legal claims).
• Portability: Receive/transfer your data in structured format (for automated data provided by consent or contract).
• Withdraw consent: At any time (does not affect prior processing; may affect service provision).

To exercise rights, contact support@milkandmoney.co.uk.

No fee usually required (unless unfounded/excessive). We may need identity verification info. We aim to respond within one month (longer for complex cases).