Adviser Terms of Business & Data Processing Agreement

Part A — Adviser Terms of Business

A1. Parties and structure

These Adviser Terms of Business ("Adviser Terms") and the Data Processing Agreement in Part B (the "DPA") together govern the provision of the Wealth365 platform (the "Platform") by Wealth365 Ltd, a company registered in Northern Ireland (company number NI740485) with its registered office at 19 Milltown Street, Warrenpoint, Co. Down BT34 3PS ("Wealth365", "we", "us"), to a professional adviser firm (the "Firm", "you"). The consumer Terms and Conditions apply to individual consumer accounts and do not govern the Firm's use of the Platform for its clients; where a Firm's client also holds their own Wealth365 login, the consumer terms govern that individual relationship separately.

A2. The service and regulatory position

• The Platform provides financial-planning illustration, projection, and practice-management tooling for use by the Firm in its own professional work. It does not provide regulated financial advice, and Wealth365 is not authorised or regulated by the Financial Conduct Authority.
• The Firm is solely responsible for any advice it gives, for its own FCA permissions, and for its own compliance obligations (including Consumer Duty obligations extending to its toolchain).
• Where the Firm records anti-money-laundering or know-your-client evidence on the Platform, the Firm is the regulated entity holding the MLR-2017 obligation; the Platform stores that evidence on the Firm's behalf as its processor.
• White-label disclosure. Where the Firm deploys white-label branding, the Firm must ensure that an equivalent "illustration, not advice" disclaimer remains visible to its end clients.

A3. Roles under data protection law

For personal data of the Firm's clients that the Firm (or its staff) enters, uploads, or causes to be processed on the Platform ("Firm Client Data"), the Firm is the controller and Wealth365 is the processor. The DPA in Part B applies to all such processing. For the Firm's own account data (staff logins, billing), and for data of individuals who hold their own consumer relationship with Wealth365, Wealth365 is an independent controller as described in the Privacy Policy.

A4. Term and termination

• Either party may terminate on 30 days' written notice; Wealth365 may suspend or terminate immediately for material breach, non-payment, or serious security or legal risk.
• On termination, the return-and-deletion process in DPA clause B8 applies to all Firm Client Data.

Part B — Data Processing Agreement (UK GDPR Article 28)

B1. Subject matter, duration, nature and purpose

Wealth365 processes Firm Client Data for the duration of the Adviser Terms, solely to provide the Platform's financial-planning, client-management, onboarding/KYC record-keeping, meeting, and reporting features to the Firm. The categories of data subjects, categories of personal data, lawful-basis mapping, and retention periods are those recorded in the platform's Records of Processing Activities (processor activities register) and the data-retention schedule, copies of which are available to the Firm on request (dpo@wealth365.co.uk).

B2. Processing on documented instructions — Art. 28(3)(a)

Wealth365 shall process Firm Client Data only on the Firm's documented instructions, including with regard to international transfers, unless required to do so by UK law (in which case Wealth365 shall inform the Firm of that legal requirement before processing, unless the law prohibits it). The Adviser Terms, the Firm's configuration of the Platform, and the Firm's use of Platform features constitute the Firm's documented instructions. Wealth365 shall immediately inform the Firm if, in its opinion, an instruction infringes UK GDPR.

B3. Confidentiality — Art. 28(3)(b)

Wealth365 ensures that persons authorised to process Firm Client Data are bound by contractual or statutory obligations of confidentiality, and that access is restricted on a need-to-know basis.

B4. Security — Art. 28(3)(c) / Art. 32

Wealth365 implements appropriate technical and organisational measures, including: TLS encryption in transit; field-level encryption at rest (Fernet, AES-128-CBC with HMAC-SHA256) for sensitive personal and financial fields; bcrypt password hashing; PII scrubbing before any error-monitoring event leaves the environment; append-only audit logging; and access controls. Section 10 of the Privacy Policy describes these measures.

B5. Sub-processors — Art. 28(2), 28(3)(d), 28(4)

• The Firm grants general written authorisation for the sub-processors listed in Section 6.2 of the Privacy Policy (the authoritative, maintained sub-processor table: hosting, error monitoring, payments, backup storage, and email delivery), on the safeguards recorded there.
• Wealth365 shall inform the Firm of any intended addition or replacement of a sub-processor at least 30 days before it takes effect, giving the Firm the opportunity to object on reasonable data-protection grounds.
• Wealth365 imposes data-protection obligations on each sub-processor equivalent to those in this DPA and remains fully liable to the Firm for the sub-processor's performance.

B6. Assistance to the controller — Art. 28(3)(e), (f)

• Wealth365 shall, taking into account the nature of the processing, assist the Firm by appropriate technical and organisational measures in fulfilling the Firm's obligation to respond to data-subject rights requests (access, rectification, erasure, restriction, portability, objection) concerning Firm Client Data. The Platform's export tooling supports this; requests are actioned within 10 business days of the Firm's written request, and in any event within timescales that allow the Firm to meet its one-month statutory deadline.
• Wealth365 shall assist the Firm with its Article 32–36 obligations (security, breach notification, data protection impact assessments, prior consultation), taking into account the nature of the processing and the information available to it.

B7. Personal data breach notice

Wealth365 shall notify the Firm without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Firm Client Data, providing the information described in Article 33(3) UK GDPR so far as available (nature of the breach, categories and approximate numbers of data subjects and records, likely consequences, and measures taken or proposed). Wealth365's internal incident-response policy operationalises the Article 33/34 decision path. As between the parties, the Firm is responsible for any notification to the ICO or to data subjects in respect of Firm Client Data; Wealth365 will provide reasonable cooperation.

B8. Return and deletion on termination — Art. 28(3)(g)

• On termination or expiry of the Adviser Terms, Wealth365 shall, at the Firm's choice, return the Firm's client-book data to the Firm in a structured, commonly used, machine-readable format (JSON with integrity checksum) via secure delivery, and shall then delete the Firm Client Data on the documented schedule: deletion within 30 days of confirmed export delivery.
• Statutory retention carve-out: KYC and AML evidence recorded through the Platform's onboarding flow is retained for 5 years post-termination in support of the Firm's MLR-2017 regulation 40 obligation, then purged in full. Retained records are flagged at termination and are not used for any other purpose.
• Clients of the Firm who separately hold their own Wealth365 consumer account retain that independent relationship; termination of the Firm removes the Firm's access and the Firm-context links, not the client's own account.

B9. Audit and information — Art. 28(3)(h)

Wealth365 shall make available to the Firm information reasonably necessary to demonstrate compliance with this DPA (including the ROPA extract for processor activities, retention schedule, sub-processor list, and security summaries), and shall allow for and contribute to audits, including inspections, conducted by the Firm or its mandated auditor — no more than once per 12 months except following a personal data breach, on 30 days' notice, during business hours, without access to other customers' data.

B10. International transfers

Routine hosting and processing take place in the EEA (covered by the UK adequacy regulations); ancillary access and specific sub-processor flows from the United States are covered by Article 46 safeguards, as described in Privacy Policy Sections 6.2 and 7. Wealth365 shall not transfer Firm Client Data outside the UK/EEA other than as described there without the Firm's prior written instruction.

B11. Liability and precedence

Liability under this DPA is subject to the limitations in the Adviser Terms, save that nothing limits either party's liability where UK GDPR prohibits such limitation. In the event of conflict between the DPA and the Adviser Terms concerning processing of Firm Client Data, the DPA prevails.

Contact

Wealth365 Ltd — Registered in Northern Ireland, company number NI740485
19 Milltown Street, Warrenpoint, Co. Down BT34 3PS
Data protection enquiries: dpo@wealth365.co.uk