Privacy policy
Your data, handled with care: what we collect, why we need it, who we share it with and the choices you have.
Your data, handled with care
We're Whistle. We give people guidance and regulated financial advice at life's key moments, inside the apps and platforms they already trust.
Good advice and guidance depends on trust. This policy explains, in plain English, what personal data we collect, why we need it, who we share it with and the choices you have.
This policy applies if you:
- Use Whistle, including through a bank, pension provider, investment platform or other partner that offers Whistle inside its own app or website
- Use Whistle's retirement planning, annuity comparison or guidance tools
- Visit our website
- Contact us, take part in National Annuity Day, or sign up to hear from us
- Work for one of our partners, suppliers or annuity providers and we deal with you in a business capacity
We may give you a short, specific privacy notice at particular points, for example when we ask about your health. Please read those alongside this policy.
Our services are for adults. We don't knowingly collect personal data from anyone under 18.
Last updated: 1 October 2026
Who we are
Whistle and Pension Potential are trading names of Embedded Advice Limited, authorised and regulated by the Financial Conduct Authority (FRN 1044275). We're registered in England and Wales (company number 16421873) at Labs Atrium, Chalk Farm Road, London, NW1 8AH.
In this policy, "Whistle", "Pension Potential", "we", "us" and "our" mean Embedded Advice Limited.
Our role with your data
We're the controller of your personal data when we give you advice or guidance, or run our tools. That means we decide how and why your data is used, and we're responsible for protecting it.
Many people reach us through a partner, such as their bank or pension provider. Where that happens:
- The partner is a separate controller for the data it already holds about you, under its own privacy policy
- We're the controller for the data we collect and create when we advise or guide you
We may also act as a processor if a partner shares information with us. In these cases we will only act on the partner's instructions. Where this applies, the partner's privacy policy explains how your data is used.
How to contact us
Our Data Protection Officer looks after this policy and any questions about your data.
- Email: hello@askwhistle.co.uk
- Post: Data Protection, Whistle, Labs Atrium, Chalk Farm Road, London, NW1 8AH
- Phone: 0333 015 1670
The data we collect
We only collect what we need to give you advice or guidance that's right for you. What that is depends on the service you use.
| Type of data | Examples |
|---|---|
| Identity | Name, title, date of birth, gender, marital status, National Insurance number, proof of identity |
| Contact | Home address, email address, phone number |
| Financial circumstances | Income, spending, savings, investments, debts, property, tax position, dependants |
| Financial products | Providers, policy numbers, policy or product information, fund values and contributions |
| Health and lifestyle | Medical conditions, medication, height, weight, smoking and drinking habits, used to find enhanced annuity rates (see "Health data and extra support") |
| Technical and usage | IP address, device and browser type, pages viewed, how you use our tools, collected through cookies and similar technologies |
Information about other people
You may tell us about your partner, spouse or dependants, for example to model a joint-life annuity. Please only share their details if they have agreed to you doing this and you've pointed them to this policy.
Business contacts
If you work for a partner, annuity provider, supplier or sponsor, we may hold your name, job title, work contact details and records of our dealings with you.
Where your data comes from
From you. When you use our advice or guidance journey, chat and tools, speak to an adviser, upload documents or get in touch.
From the partner you came through. If you start your journey in your bank's, pension provider's or other partner's app or website, they may pass us details such as your name, contact details and the products you hold, so you don't have to type them again. They'll only do this in line with their own privacy policy.
From your product providers. With your permission, usually a signed letter of authority, we ask your existing providers for details of your pensions, investment or insurance policies. When you ask for annuity quotes, providers send us quotes based on the information you've given us.
From other organisations. Including:
- Identity verification, fraud prevention, sanctions and politically exposed person screening services
- The Pensions Dashboards ecosystem, pension tracing services or the State Pension forecast service, where you ask us to use them
- Public sources such as the electoral register and Companies House
Automatically. When you use our websites and tools, through cookies, server logs and similar technologies. See "Cookies" below.
How we use your data, and why we're allowed to
Data protection law says we must have a lawful basis for every use of your data. Here's what we do and the basis we rely on.
| What we do | Lawful basis |
|---|---|
| Give you regulated advice: understand your circumstances, assess suitability, make and explain recommendations | Contract |
| Implement the advice we provide to you | Contract |
| Run retirement modelling, annuity comparison and guidance tools | Contract |
| Get annuity quotes and put your chosen plan in place with providers | Contract |
| Contact you about your advice, account or service | Contract |
| Verify your identity and check for fraud, money laundering and sanctions | Legal obligation; legitimate interests (preventing fraud) |
| Keep advice records, record calls and meet regulatory requirements, including Consumer Duty | Legal obligation |
| Handle complaints and deal with the Financial Ombudsman Service | Legal obligation; legitimate interests |
| If applicable, tell your existing provider/our partner what we've done for you | Contract; legitimate interests |
| Improve our advice, tools and websites, including quality checks on advice | Legitimate interests |
| Keep our systems and your data secure | Legitimate interests; legal obligation |
| Send you marketing | Consent, or legitimate interests for similar services to ones you've used (see "Messages and marketing") |
| Use non-essential cookies | Consent |
| Use your health and lifestyle data for enhanced annuity quotes | Explicit consent (see "Health data and extra support") |
Legitimate interests means we use your data in ways you'd reasonably expect, where our reasons don't outweigh your rights. We balance these carefully and you can ask us for details.
If you don't give us information we need, we may not be able to give you guidance or advice, or our advice may not be suitable. We'll tell you if that's the case.
We'll only use your data for a new purpose if it's compatible with why we collected it, or if we have your consent or the law allows it.
Health data and extra support
Some information is especially sensitive, and the law gives it extra protection. For us, this is mainly information about your health.
Enhanced annuities. Health and lifestyle factors can mean you qualify for a higher guaranteed income. To find these rates, we ask about your health and share it with annuity providers for quotes. We'll only do this with your explicit consent, which we'll ask for clearly at the time. You can withdraw it whenever you like, though we may then only be able to show standard rates.
Extra support. If you tell us about your health, a life event such as bereavement, or anything else that affects how we should support you, we'll record it so we can adapt how we work with you. We do this to meet our FCA duty to treat customers in vulnerable circumstances fairly. Only people who need to know will see it.
Messages and marketing
Service messages. We'll send you messages you need about your advice, reports, account and any changes to our terms. These aren't marketing, so you can't opt out while you use our services.
Marketing. We'd like to tell you about services, tools and retirement insights that might help.
We'll only send marketing by email or text:
- with your consent, or
- if you're an existing customer and it's about similar services, and you haven't told us to stop
Every marketing message has an easy way to unsubscribe. You can also change your preferences in your account or by emailing hello@askwhistle.co.uk.
Through partners. If you came to us through a partner, we won't market to you on their behalf, and we won't use your details to promote other firms.
Online advertising. We may share a scrambled (hashed) version of your email address with advertising platforms such as Google, Meta or LinkedIn, to show you relevant ads or to stop showing you ads for things you already use. You can manage ad settings on each platform.
Who we share your data with
We only share what's needed with people who need it, and we never sell your data.
| Who | Why |
|---|---|
| The partner you came to us through | To confirm you've used Whistle, implement our advice, share the outcome and let them support you as your provider |
| Pension, annuity and investment providers | To get information about your pensions, get quotes, and put your chosen recommendation or application in place |
| Service providers working for us | Cloud hosting, software, identity checks, e-signatures, call recording, customer support and analytics, only on our instructions |
| Other companies in the Whistle group | To run our services and for group reporting |
| Professional advisers | Auditors, lawyers, insurers and compliance consultants |
| Regulators and public bodies | The FCA, Financial Ombudsman Service, ICO, HMRC, courts and law enforcement, where the law requires it |
| Fraud prevention agencies | To prevent fraud and money laundering |
| A buyer or investor | If we sell or restructure all or part of our business, under strict confidentiality |
Our service providers must keep your data secure and use it only as we instruct, under a written contract.
Fraud prevention. If we or a fraud prevention agency believe you pose a fraud or money laundering risk, we may refuse to provide services. Agencies keep records that others may see, which could affect your access to financial services. You have rights over this data, and can contact us to find out which agencies we use.
Transfers outside the UK
We store your data in the UK and the EEA wherever we can. Some of our service providers may access or store data in other countries, such as the United States.
When data leaves the UK, we make sure it's protected to the standard UK law requires, by:
- Using countries the UK government has approved as having adequate protection, including the UK-US Data Bridge for certified US companies
- Signing the ICO's International Data Transfer Agreement, or the Addendum to the EU Standard Contractual Clauses
Technology, automated decisions and AI
Our digital advice and guidance journeys and tools use technology to analyse your answers, model growth and income and suggest options. We don't make decisions that have a legal or similarly significant effect on you based solely on automated processing. If this ever changes, we'll tell you first. You'll always be able to ask for a person to review a decision, share your view and challenge it.
If your situation is straightforward, you may get an investment recommendation generated automatically to give you fast, affordable advice when you need it, as part of the service you've asked us for. With all of our recommendations, or at any point in our guidance or advice journeys, you can choose to speak to an adviser.
If you get an automated recommendation, you can:
- Ask us to explain how it was reached
- Tell us your views or give us more information
- Ask a qualified adviser to review it, free of charge
- Challenge the outcome
To do this, use the contact your adviser link shown on screen, or contact us at hello@askwhistle.co.uk.
We use carefully selected AI tools to help us work more efficiently, for example to transcribe and summarise calls or to prepare a first draft of your reports. A qualified person always oversees these tools, and AI never makes decisions about you on its own. The providers of these tools act only on our instructions, under contracts that stop them using your personal data to train their own AI models.
How long we keep your data
We keep your data only as long as we need it. Pension and retirement advice can affect you for decades, and the rules on keeping advice records are strict, so some records are kept for a long time.
| Data | How long |
|---|---|
| Advice records, including fact-finds and suitability reports | At least 10 years after our relationship ends |
| Pension transfer or conversion advice | Indefinitely, as FCA rules require |
| Identity and anti-money laundering checks | 5 years after our relationship ends |
| Call recordings and chats | 5–7 years |
| Annuity guidance and modelling, where no advice was given | 6 years after your last activity |
| Enquiries from people who don't become customers | 2 years |
| Marketing preferences | Until you opt out, then kept on a suppression list so we don't contact you again |
| Cookie and analytics data | See our Cookie Policy |
When we no longer need your data, we securely delete it or anonymise it so it can't identify you.
Keeping your data safe
We keep your data protected. This includes encryption in transit and at rest, strict access controls so only people who need your data can see it, regular security testing, and staff training.
If something goes wrong, we have procedures to deal with it quickly. If a breach is likely to put you at high risk, we'll tell you without undue delay, and we'll report it to the ICO where required.
Please keep your login details private. We'll never ask for your password by phone, email or text.
Your rights
UK data protection law gives you rights over your data. You can ask us to:
- Access your data: get a copy of what we hold and how we use it
- Correct it: fix anything inaccurate or incomplete
- Delete it: in some circumstances we may need to keep advice records by law
- Restrict it: pause how we use it, for example while we check its accuracy
- Object: stop using it where we rely on legitimate interests, and stop direct marketing at any time
- Move it: get data you've given us in a format you can take elsewhere
- Withdraw consent: at any time, where we rely on it. This won't affect what we've already done
- Automated decisions: ask how one was reached, give your views, ask an adviser to review it, and challenge it
To use any of these rights, email hello@askwhistle.co.uk or write to us. It's free, and we'll reply within one month. If your request is complex, we may need up to two more months and will tell you why. We may ask you to confirm your identity first.
If you came through a partner, you can also contact them about the data they hold.
Cookies
Our websites and tools use cookies and similar technologies. Some are essential to make things work, like keeping you logged in. We only use others, for analytics or advertising, if you agree. You can change your choice at any time using the cookie settings link at the bottom of every page.
When Whistle runs inside a partner's app or website, the partner's own cookie policy covers cookies they set.
Our Cookie Policy lists the cookies we use and how long they last.
Links to other websites
Our websites may link to other sites, including partners and providers. We're not responsible for how they handle your data, so please check their privacy policies.
Complaints and changes
Not happy? Please tell us first, at hello@askwhistle.co.uk. We'll acknowledge your complaint within 30 days and aim to put things right quickly.
You also have the right to complain to the Information Commissioner's Office at any time:
- Website: ico.org.uk/make-a-complaint
- Phone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Changes to this policy
We review this policy regularly. If we make important or significant changes, we'll tell you before they take effect, by email or in your account. The date at the top shows when it was last updated.