Hedderman Financial Solutions is committed to protecting and respecting your privacy. We aim to be transparent about how we process your personal data and to demonstrate our accountability under the GDPR.
For GDPR purposes, the data controller is Hedderman Financial Solutions Ltd, trading as Hedderman Financial Solutions.
Contact details: 35 Marlfield, Cabinteely, Dublin 18. Email: compliance@hedderman.ie
When we refer to ‘we’ or ‘us’, we mean Hedderman Financial Solutions.
Please read this Privacy Notice carefully. It explains the basis on which any personal data we collect from you, or that you provide to us, will be processed by us.
Hedderman Financial Solutions Ltd, trading as Hedderman Financial Solutions, provides financial planning, investment and pension advice, and arranges life insurance, mortgage protection, income protection and specified illness cover for our clients. We are regulated by the Central Bank of Ireland (Financial Services Registration Number C44394). We are registered in Ireland (Company Registration Number 430074), with our registered office at 35 Marlfield, Cabinteely, Dublin 18.
Responsibility for data protection matters is held by our Data Protection Contact, who can be reached directly:
The personal information we collect varies depending on the services we provide. Below is an overview of the categories of personal data we collect and why we use that data. We only collect what is necessary and proportionate for the advice, product or service concerned.
3.1 How we collect information
We collect personal data where you:
3.2 What information we collect
Depending on the service you use, the information we collect about you may include:
| 1 | Contact and identifying information: name, address, contact details, email, mobile, landline. |
| 2 | Unique identifiers: PPS number (where required for pension, tax or Revenue reporting purposes), pension scheme reference numbers, and life assurance/protection policy numbers. |
| 3 | Demographic details: age, gender, marital status, date of birth, dependants and, where relevant to your fact find, photo ID for identity verification. We may also process personal information about other people relevant to your financial plan (e.g. a spouse, partner or children named as dependants or beneficiaries). |
| 4 | Family and beneficiary data: dependants, next of kin or nominated beneficiaries, Power of Attorney or Enduring Power of Attorney, and details of your solicitor, tax adviser or accountant where relevant to your financial plan. |
| 5 | Employment information: role, employment status (full/part time, contract), salary information, employment benefits and employment history. This information is necessary for our Fact Find with clients. |
| 6 | Publicly available sources: information about you in the public domain, such as director information from the Companies Registration Office. |
| 7 | Health information: information about your health status, medical history and medical assessment outcomes, including personal habits (e.g. smoking, alcohol consumption). We only collect this where relevant to arranging or underwriting a life assurance, protection, income protection or specified illness policy on your behalf, and we treat it as a special category of personal data (see section 13). Where you provide health information as part of a form supplied directly by a product provider, we pass this on to that provider and do not retain a copy of it on our own systems or CRM beyond what is necessary to complete that submission. |
| 8 | Pensions and insurance benefits information: current benefits, pension entitlement information, date of retirement and any relevant matters impacting your benefits, such as voluntary contributions. |
| 9 | Financial details: bank account details, income and expenditure, details of your credit history, salary, tax status, and other information needed to assess your financial position and provide suitable advice. |
| 10 | Claims data: from you and, where relevant, third parties such as product providers, where you make a claim on a life assurance, protection, income protection or specified illness policy arranged through us. |
| 11 | Marketing preferences: we will only send you direct marketing where you have given your explicit consent. You can withdraw that consent at any time (see section 4). |
| 12 | Online information: information about your visits to our website. See our Cookie Notice: www.hedderman.ie/cookies. |
| 13 | Events information: information about your interest in and attendance at any events we run, including feedback forms. |
| 14 | Social media information: connected with our social media presence on LinkedIn/Facebook/Instagram. |
| 15 | Searches we undertake in relation to sanctions and anti-money laundering, using our BIS CRM system. |
| 16 | Criminal offence data: information about actual or alleged criminal offences that may come to light through anti-money laundering, sanctions, Politically Exposed Person (PEP) or bankruptcy checks we carry out as part of our regulatory obligations. We only process this data to the extent necessary for those checks, and in accordance with the safeguards required under Irish law for this category of data. |
Where we collect any special category (sensitive) personal data as defined by the GDPR, we ensure this is necessary and that we have your explicit consent and/or another valid legal basis prior to collection (see section 13).
3.3 Information we automatically collect
When you visit our website and when we communicate with you by email, automated technologies may collect certain information (e.g. IP addresses, cookies, web beacons). Functional, marketing and analytical cookies are only used with your express consent. Further information about our use of cookies can be found in our Cookie Notice, available at the footer of our website (www.hedderman.ie).
Your personal data will be used to enable us to fulfil our contractual obligations in relation to your request for financial planning, investment, pension or protection advice, and related products. We rely on the following lawful bases under the GDPR for each processing purpose.
If you require further information on any of the above bases for processing your data, we can provide you with further details.
When required, we may make your information available to third parties with whom we have a relationship, where that third party is providing services on our behalf. We only provide those third parties (data processors) with information necessary for them to perform the services. We take measures to protect your information, such as data processing agreements and confidentiality agreements.
Recipients may include:
| 1 | Product providers: life assurance, pension and investment product providers we need to work with to manage the services provided to you. |
| 2 | Vetting and risk management agencies: fraud prevention, criminal record, data validation and other professional advisory agencies, where necessary to prevent and detect fraud and to assess risk in relation to your policies or services. |
| 3 | Legal advisers and claims investigators: where necessary to investigate, exercise or defend legal claims, or claims under your policy. |
| 4 | Medical professionals: where you provide health information in connection with a life assurance/protection application or claim. |
| 5 | EU law enforcement bodies: when required to do so by law, regulation or another legal request. |
| 6 | Public authorities, regulators and government bodies: including the Central Bank of Ireland, the Financial Services and Pensions Ombudsman and the Data Protection Commission, where necessary for us to comply with our legal and regulatory obligations, or in connection with an investigation of suspected or actual illegal activity. |
| 7 | Third-party processors: we outsource certain processing operations to suppliers who process personal information on our behalf, such as our CRM provider and Microsoft 365 (including Microsoft Teams), and our accounting, payroll and other back-office software providers. These processing operations remain under our control, and we have data processing agreements in place with all our third-party processors. Where our processors use sub-processors outside the EEA (for example in the United States), we rely on EU Standard Contractual Clauses and complete transfer impact assessments. |
Where we transfer personal data to a country outside the EEA (a ‘third country’ under the GDPR), we ensure this is done lawfully, i.e. there is an appropriate level of protection for the fundamental rights of data subjects. We ensure that either the EU Commission has granted an adequacy decision in respect of the third country, or that appropriate safeguards are in place (e.g. Standard Contractual Clauses (SCCs), supplemented by transfer impact assessments where required).
The security of your personal data is important to us. We have implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk, and have processes in place to protect your personal data from loss, unauthorised access, misuse, alteration and destruction.
Hedderman Financial Solutions shall not keep personal data in a form that permits identification of data subjects for longer than is necessary.
We may store data for longer periods where it will be processed solely for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, subject to appropriate technical and organisational measures to safeguard your rights and freedoms.
We will retain your personal data for as long as our relationship with you continues, and afterwards for the period necessary to meet our legal, regulatory and tax obligations. As a general rule, and unless a longer period applies under specific legislation, our records are retained for a minimum of six years from the end of our relationship with you, in line with the Central Bank of Ireland’s record-keeping requirements. For prospective clients who do not proceed to become clients, we typically retain information for up to 2 years from our last contact, unless AML files were opened or another legal requirement applies.
We are in the process of finalising a detailed Retention Schedule setting out the specific retention period for each category of personal data we hold. Further information is available on request. Personal data will be disposed of securely.
Hedderman Financial Solutions will facilitate your rights in line with our data protection policy and our Subject Access Request procedure, which is available on request.
At any point while we are in possession of or processing your personal data, you, the data subject, have the following rights:
We may require proof of identity before we can action certain requests. All the above requests will be forwarded on, should there be a third party involved, as indicated in the processing of your personal data described in this notice.
If you wish to make a complaint about how your personal data is being processed by Hedderman Financial Solutions, or about how your complaint has been handled, you have the right to lodge a complaint with our Data Protection Contact, in line with our Complaints Policy.
You may also lodge a complaint with the Data Protection Commission (DPC) in Ireland:
Data Protection Commission
6 Pembroke Row, Dublin 2, D02 X963
Website: www.dataprotection.ie
If we are collecting your data for a contract and you cannot provide this data, the contract may not be capable of being completed, or details we hold may be incorrect. Where you fail to provide us with information we require to fulfil our obligations to you, we may be unable to offer our services to you.
12. Special categories of personal data
Special categories of data are sensitive in relation to your fundamental rights and freedoms, and therefore require specific protection when processed, as they could create significant risks to individuals’ rights and freedoms.
If we collect any special categories of personal data, such as health data, we will either obtain your explicit consent, or we will rely on the Data Protection Act 2018, which allows us to process special categories of personal data for insurance and pension purposes. We will ensure suitable and specific measures are in place to safeguard your rights and freedoms when processing this data. These measures relate to:
The mortgaging of a property, for example where mortgage protection cover requires health information.
13. Contact us
Your privacy is important to us. If you have any comments or questions regarding this notice, please contact us at compliance@hedderman.ie.
14. Privacy notice changes
When we update this Privacy Notice, we will post a revised version on our website. Changes will be effective from the point at which they are posted. We encourage you to review our Privacy Notice periodically so that you are aware of any updates.
This Privacy Notice was last reviewed in May 2026. Version 2.0.