Data Protection Complaints Procedure

1. What this procedure covers

This procedure is for complaints about how we collect, use, store, share or protect personal data on the Bloom platform. For example:

• how your personal data (or your clients' personal data, if you are an adviser) has been handled;
• a response — or lack of response — to a data-rights request (access, rectification, erasure, portability, restriction or objection);
• concerns about marketing communications, cookies, meeting recordings or AI-assisted features;
• concerns about a suspected personal-data breach.

It is not for complaints about financial advice. If you are a client of a financial advice firm that uses Bloom, complaints about the advice itself go to your advice firm under its FCA-regulated complaints process. General product support questions should go through the normal support channels.

If you are a client of an advice firm that uses Bloom: for most of your data on the platform, your advice firm is the data controller and we process it on their instructions. You can complain to us, to them, or both — if your complaint is about something under your firm's control, we will tell you promptly, pass it to them if you agree, and help them resolve it.

2. How to complain

Email privacy@bloomflow.app with the subject line “Data protection complaint”, or write to: Data Protection Complaints, Arthur Browns Wealth Management Ltd, Titan House, 13 Station Road, Horsforth, Leeds LS18 5PA.

Please tell us: who you are and how to contact you; what happened and when; what data is involved; and what outcome you are looking for. You do not need to use any special form or legal language. If you need this procedure in another format, ask and we will accommodate where we reasonably can.

3. What we will do, and when

• Acknowledge within 30 days of receiving your complaint — our target is within 5 working days.
• Investigate without undue delay. A named person will own your complaint. If we need to verify your identity or ask you to clarify your complaint, the time waiting for your reply does not count toward our response time.
• Respond substantively — our target is within 30 days of acknowledgement. If a complex complaint needs longer, we will tell you why and give a revised date.
• Our response will set out what we found, what we have done or will do about it (including correcting, restoring or deleting data where appropriate), and anything we have changed to stop it happening again.
• We log every data-protection complaint and review the log at least annually to identify recurring issues.

4. If you are not satisfied

You can ask us to review the outcome — a person not involved in the original handling will review it. You also have the right at any time to complain to the Information Commissioner's Office (ICO) — 0303 123 1113 · Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — and you may have the right to take judicial action. Complaining to us first is not a legal precondition of complaining to the ICO, but the ICO will normally expect us to have had the opportunity to respond.

5. No detriment

Making a complaint will never affect the service you or your firm receive from us.