Privacy Policy

Introduction

Welcome to MOMENTUM RISK SOLUTIONS UK LTD website privacy notice (the “Privacy Notice”).

Momentum Risk Solutions UK Ltd is a private limited company incorporated in the United Kingdom under registration number /15937330/ and have our registered office at 4 Prince’s Court, Prince’s Road, Ferndown, Dorset, United Kingdom, BH22 9JG.

Momentum Risk Solutions UK Ltd is a Managing General Agent. Where regulated activities are carried out in the United Kingdom, they are conducted as an Appointed Representative of Milestone Risk Solutions Limited (the “Principal”), which is authorised and regulated by the Financial Conduct Authority (Firm Reference Number 8397254).

Momentum Risk Solutions UK Ltd (collectively referred to as “Momentum”, “we”, “us” or “our” in this Privacy Notice) respects your privacy and is committed to protecting your personal data.

It is important that you read this Privacy Notice together with any other policy we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This Privacy Notice supplements other notices and policies and is not intended to override them.

The information set out in this Privacy Notice applies differently depending on your relationship with us. We process personal data only to the extent necessary for the particular purpose for which you engage with us.

BY USING OUR SERVICES OR PRODUCTS, VISITING OUR SITE, CORRESPONDING WITH US, OR OTHERWISE INTERACTING WITH US, YOU CONFIRM THAT YOU HAVE READ AND UNDERSTOOD THIS PRIVACY NOTICE, WHICH EXPLAINS HOW YOUR PERSONAL DATA IS PROCESSED IN ACCORDANCE WITH ITS TERMS AND APPLICABLE DATA PROTECTION LAWS.

IMPORTANT INFORMATION AND WHO WE ARE

Purpose of this privacy notice

This Privacy Notice will inform you as to how we collect and use your personal data when you use our website momentum.uk (our “Site”), including any personal data you may provide when you contact us, submit enquiries, apply for roles, or otherwise communicate with us.

Children’s data

Our Site is not intended for children and we do not knowingly collect data relating to children.

Controller

Momentum is the controller and is responsible for your personal data in relation to your use of the Site.

In some limited circumstances, we may act as a joint data controller with the Principal, where we jointly determine the purposes and means of processing your personal data. In such cases, we and the Principal have entered into an arrangement that sets out our respective responsibilities in accordance with applicable data protection laws. You may exercise your data protection rights by Contacting Us, and we will coordinate with the Principal where necessary.

We have appointed a data protection contact person who is responsible for overseeing questions in relation to this Privacy Notice. If you have any questions about this Privacy Notice or our privacy practices, including any requests to exercise your legal rights, please contact us using the following details:

Email address: info@momentum.uk

Complaints

You have the right to make a complaint to the Information Commissioner’s Office (the “ICO”), the United Kingdom regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach any regulator(s), so please make sure to Contact Us in the first instance. The ICO will expect you to have done this before reviewing your complaint. 

Changes to the privacy notice and your duty to inform us of changes

We keep our Privacy Notice under regular review. You may wish to revisit it regularly.

This Version was last updated on the 1^st of December 2025. Historic versions can be obtained by Contacting Us.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

Third-party links

Our Site may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you.  We do not control these third-party websites and are not responsible for their privacy notices or data protection practices. When you leave our Site, we encourage you to read their privacy notice and the privacy notice of every website you visit.

Glossary

“Legitimate Interests” means our interest in conducting and managing the activity of Momentum. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests.  We do not use your personal data for activities where our legitimate interests are overridden by your interests or rights, unless we have your consent or we are otherwise required or permitted to by law. You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by Contacting Us.

“Comply with a legal obligation” means processing your personal data where it is necessary for compliance with a legal or regulatory obligation that we are subject to.

“Consent” means a freely given, specific, informed and unambiguous indication of your agreement to the processing of your personal data by us for a specific purpose. Where we rely on consent as a lawful basis for processing, you have the right to withdraw your consent at any time.

The TYPES of data we collect about you

Data we collect

Personal data, or personal information, means any information about an identified or identifiable individual.

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• Identity Data includes first name, last name, any previous names, marital status, title, and date of birth.
• Contact Data includes address, email address and telephone number.
• Technical Data includes internet protocol (IP) address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, device ID and other technology on the devices you use to access the Site.
• Usage Data includes information about how you interact with and use our Site, products and services.

We also collect, use and share aggregated data such as statistical or demographic data for any lawful purpose. Aggregated Data may be derived from your personal data but is not considered personal data in law as it will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of visitors accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Privacy Notice.

We do not request or intentionally collect through our Site any “Special Categories of Personal Data” about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sexual life, sexual orientation, political opinions, trade union membership, information about your physical or mental health conditions, and genetic and biometric data). Nor do we collect any information about criminal records. You are asked not to provide such information through the Site or by other means. If, despite this, you submit such information voluntarily, we will take reasonable steps to restrict access to it and delete it as soon as reasonably practicable, in accordance with applicable data protection law.

Failure to provide personal data

Where we need to collect personal data as required by law, or where such personal data is necessary for us to provide access to our Site or services, and you fail to provide that data when requested, you may not be able to access all or parts of our Site and/or have access to our services and products, and we may be unable to perform our obligations to you. Where personal data is optional, this will be made clear at the point of collection.

How is your personal data collected?

We use different methods to collect data from and about you including through:

Your interactions with us. You may give us your personal data by filling in online forms on our Site or by corresponding with us by phone, email or otherwise. This includes personal data you provide when you:

• engage with us in a business context, including where you request to receive information about our products and/or services;
• upload your resume through our career portal; or
• give us feedback or contact us.

Information received from the Principal. In some cases, we may receive personal data from the Principal where this is necessary in connection with our interactions with you or for related regulatory or operational purposes.

Automated technologies or interactions. As you interact with our Site, we will automatically collect Technical Data and Usage Data about your equipment, browsing actions and patterns.  We collect this personal data by using cookies, server logs and other similar technologies. We may receive aggregated Technical Data from third-party analytics providers, including where such providers use cookies or similar technologies across multiple websites. We do not receive information that directly identifies you or details of your activity on those other websites. Please see our Cookie Policy for further details.

Third parties.  As you interact with our Site, we may receive limited aggregated Technical Data and Usage Data from third-party analytics providers (for example, Google), which may be based outside the United Kingdom. This data is used to understand how our Site is used and to improve its performance.

How we use your personal data

Legal basis

We will only use your personal data when the law allows us to, relying on one or more of the following legal bases:

• Legitimate interests: we may use your personal data where it is necessary to conduct our business and pursue our Legitimate Interests, for example to prevent fraud and enable us to give you the best and most secure customer experience. We only use your personal data where our interests do not override your interests and fundamental rights; and/or
• Legal obligation: We may use your personal data where we need to comply with a legal obligation that we are subject to. We will identify the relevant legal obligation when we rely on this legal basis.
• Consent (limited circumstances): We generally do not rely on consent as a lawful basis for processing your personal data. However, where required by applicable law, we will obtain your consent before sending you direct marketing communications. You have the right to withdraw your consent to such marketing at any time by Contacting Us.

Purposes for which we will use your personal data

We have set out below, in a table format, a description of all the ways we plan to use the various categories of your personal data, and which of the legal bases we rely on to do so.  We have also identified what our Legitimate Interests are where appropriate.

Please note that, in some cases, we may process your personal data on more than one lawful basis, depending on the specific purpose for which it is used. If you would like further information about the lawful basis we rely on in a particular case, please Contact Us.

Direct Marketing

We may send you limited marketing communications about our products and/or services in a business-to-business context where you have requested information from us or otherwise engaged with us. We may use your Identity Data and Contact Data for this purpose.

Such communications are based on the context of your enquiry or engagement with us, and you have not opted out of receiving such communications. You have the right to object to receiving marketing communications at any time by Contacting Us. See Your legal rights below for more information.

Opting out of marketing

You may ask us to stop sending you marketing communications at any time by following the opt-out links included in such communications or by Contacting Us.

If you opt out of receiving marketing communications, you will continue to receive service-related communications that are necessary for administrative or customer service purposes. Opting out of marketing communications will not affect personal data processed as a result of your use of our Site or services.

Cookies

You can set your browser to refuse all or some cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of our Site may become inaccessible or may not function properly. For more information about the cookies we use, please see our Cookie Policy.

Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another purpose and that purpose is compatible with the original purpose. If you would like to get an explanation as to how processing for a new purpose is compatible with the original purpose, please Contact Us.

If we need to use your personal data for an unrelated purpose, we will notify you and explain the legal basis that allows us to do so.

Where required or permitted by applicable law, we may process your personal data without prior notice to you, for example to comply with a legal obligation or to protect our legal rights.

Disclosures of your personal data

We may share your personal data with the parties set out below for the purposes set out in the table Purposes for which we will use your personal data above:

• Group companies and selected third parties, where necessary to support the operation of our business, including for internal administrative, operational, or regulatory purposes, and in accordance with this Privacy Notice.
• Service providers acting as processors, who provide IT, system administration, hosting, and website administration services, which may involve processing outside the United Kingdom.
• Third parties in connection with a business transfer, including prospective sellers or buyers of our business or assets. If a change of ownership occurs to our business, then the new owner(s) may use your personal data in the same manner as set out in this Privacy Notice.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

International transfers

We share your personal data as outlined in this Privacy Notice, which might involve transferring your personal data outside the United Kingdom, including within our group companies and to our services providers.

Whenever we transfer your personal data out of the United Kingdom to countries which have laws that do not provide the same level of data protection as the United Kingdom law, we always ensure a similar degree of protection is afforded to it by implementing appropriate safeguards, including at least one of the following:

• Standard contractual clauses: We use specific standard contractual terms approved for use in the United Kingdom, which give the transferred personal data essentially the same protection as it has in the United Kingdom. To obtain a copy of these contractual safeguards, please Contact Us.
• Other lawful safeguards: Where applicable, we may rely on other safeguards recognised under United Kingdom data protection law, such as approved contractual arrangements with our service providers.

Data security

We have put in place appropriate technical and organisational security measures designed to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. Such persons will only process your personal data on our instructions and are subject to a duty of confidentiality.

We have also put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Data retention

How long will you use my personal data for?

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

By law, we are required to retain certain categories of personal data for defined periods. In particular, we may be required to retain basic information relating to our Site visitors, including Contact and Identity Data, for as long as necessary to comply with applicable legal, regulatory, accounting or reporting requirements, and for no longer than is necessary for the purposes for which the data was collected.

In some circumstances you can ask us to delete your personal data. Please see Your legal rights below for further information.

In some circumstances we may anonymise your personal data so that it can no longer be associated with you, for example for research or statistical purposes. Where we do so, we may use this anonymised information on an ongoing basis without further notice to you.

Your legal rights

You have a number of rights under data protection laws in relation to your personal data.  

You have the right to:

• Request access to your personal data. This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
• Request erasure of your personal data in certain circumstances. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your personal data unlawfully, or where we are required to erase your personal data to comply with local law.
• Please note, however, that we may not always be able to comply with your request of erasure for specific legal reasons, which will be notified to you, if applicable, at the time of your request. In addition, where we are able to comply with your request, this may affect our ability to provide certain services to you.

• Object to processing of your personal data where we are relying on Legitimate Interests as the legal basis for processing. You also have the right to object at any time to the processing of your personal data for direct marketing purposes, and we will stop such processing upon receipt of your objection. In some cases, where we are processing your personal data for purposes other than direct marketing, we may demonstrate that we have compelling legitimate grounds to continue processing which override your interests, rights and freedoms.

Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in one of the following scenarios:

• if you want us to establish the data’s accuracy;
• where our use of the data is unlawful but you do not want us to erase it;
• where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or
• you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
• Request the transfer of your personal data to you or to a third party. We will provide your personal data in a structured, commonly used and machine-readable format. This right applies only to personal data which you have provided to us, where the processing is carried out by automated means and is based on your consent.
• Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain services to you. We will advise you if this is the case at the time you withdraw your consent.

If you wish to exercise any of the rights set out above, please Contact Us.

No fee usually required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights).  However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond

We aim to respond to all legitimate requests within one month. If a request is particularly complex or if you have made a number of requests, it may take us longer. In such cases, we will notify you within one month of receiving your request and keep you informed of the progress.

_{Momentum Privacy Policy: Version 1, dated December 18, 2025}