Privacy Policy

1. Who we are

[Two Horizons — legal company name] ("we", "us", "Two Horizons") operates this website. We are the data controller (UK GDPR) / data fiduciary (DPDPA) for the personal data described below.

Registered address: [registered company address]
Company number: [company registration number, once incorporated]
Contact: [privacy@yourdomain.com]

Grievance Officer (required under India's DPDPA): [Name], reachable at [email / phone], for any data principal in India wishing to raise a concern about how their personal data is handled.

2. What we collect

When you submit our contact form, we collect:

• Full name, email address, phone number
• Where in India you're based, and confirmation that you're not resident in the UK
• Pension type and an estimated value range
• Your timeframe for acting, and anything you add in the free-text field

We also automatically store a small amount of technical data in your browser (via localStorage) purely to cache the "latest news" section so it loads faster on repeat visits — this stays on your device and isn't sent to us.

We don't currently use analytics or advertising cookies. If that changes, this policy — and, where the law requires it, a cookie consent banner — will be updated first.

3. Why we use it, and our legal basis

• To match you with a partner adviser — necessary to take the steps you request before any introduction is made (UK GDPR Art. 6(1)(b); DPDPA consent).
• To contact you about your enquiry — based on your consent, given when you tick the form's consent checkbox.
• To keep a record of enquiries — our legitimate interest in running the business accountably, balanced against your rights.

4. Who we share it with

• Formspree, Inc. (or [your actual form/CRM provider]) — processes form submissions on our behalf and forwards them to us by email. This involves a transfer of personal data to the United States; see Section 6.
• The regulated adviser(s) we match you with — we share the details you submitted so they can contact you. We'll always tell you who this is before or at the point of introduction. We do not sell your data to advertisers or unrelated third parties.

5. International transfers

Because this service operates between the UK and India, and uses a US-based form processor, your data may be transferred across borders. Where it is:

• From the UK, we rely on adequacy regulations or Standard Contractual Clauses / the UK International Data Transfer Addendum, as applicable (UK GDPR Art. 44–49).
• Under India's DPDPA, cross-border transfer is permitted except to countries the Indian government specifically restricts by notification — we don't transfer data to any such restricted destination.

6. How long we keep it

We retain enquiry data for [X months/years — set a real retention period] from your last contact with us, or until you ask us to delete it, whichever comes first — unless we're required to keep it longer for a legal or regulatory reason.

7. Your rights

If you're in the UK (UK GDPR / Data Protection Act 2018), you can ask us to: give you access to your data, correct it, erase it, restrict how we use it, or provide it in a portable format; you can also object to certain processing and withdraw consent at any time. You can complain to the Information Commissioner's Office (ICO) if you're unhappy with how we've handled your data.

If you're in India (DPDPA 2023), you have the right to access a summary of your personal data and the processing we carry out, to correct or update it, to have it erased once it's no longer needed, to withdraw consent at any time, to nominate another person to exercise your rights if you're unable to, and to lodge a grievance with our Grievance Officer (Section 1) and, if unresolved, with the Data Protection Board of India.

To exercise any of these rights, contact us at [privacy@yourdomain.com]. We'll respond within the timeframe required by the applicable law.

8. Security

We use reasonable technical and organisational measures to protect the data you share with us — including transmitting form submissions over encrypted connections (HTTPS) — but no method of transmission or storage is ever 100% secure.

9. Children

This service is intended for adults making their own financial and retirement plans. We don't knowingly collect data from anyone under 18.

10. Changes to this policy

We'll update the date at the top of this page whenever we make material changes, and where required by law, we'll notify you directly.

11. Contact us

Questions about this policy, or to exercise your rights: [privacy@yourdomain.com].