Data Protection Statement

---

(Last Updated: 31/07/2026)

1. Purpose and scope

Goodman Corporate Consultancy Ltd, trading as Goodman Corporate Finance (the Company), is committed to handling personal data lawfully, fairly and transparently in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy applies to all directors, employees, workers, contractors, consultants and any other individuals who process personal data on behalf of the Company. It covers personal data relating to clients, introducers, lenders' contacts, suppliers, employees and other third parties processed in the course of the Company's business.

The Company is registered with the Information Commissioner's Office under registration Z1828753.

2. The data protection principles

The Company will ensure that personal data is:

• Processed lawfully, fairly and in a transparent manner.

• Collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes.

• Adequate, relevant and limited to what is necessary.

• Accurate and, where necessary, kept up to date.

• Retained for no longer than is necessary, in line with the Data Retention Policy.

• Kept secure using appropriate technical and organisational measures.

The Company is accountable for these principles and must be able to demonstrate compliance with them (UK GDPR Article 5(2)). Evidence of compliance is held through this policy, the Data Retention Policy, the privacy notices, training records and the breach register.

3. Lawful bases and transparency

Personal data is processed only where a lawful basis applies: performance of a contract, compliance with a legal obligation, the Company's legitimate interests, or consent where required for specific activities. The lawful bases relied on for client data are set out in the Privacy Notice and DPA issued to clients, and in the Introducer Privacy Notice and Employee Privacy Notice for those audiences. Privacy notices are issued before or at the point personal data is collected.

4. Responsibilities of individuals

Everyone who processes personal data for the Company must:

• Access personal data only where necessary for their role.

• Never disclose personal data to unauthorised individuals.

• Keep personal data secure at all times, including when working remotely, in line with the Clear Desk Policy and the Home and Remote Working Policy.

• Follow all Company procedures relating to data protection and confidentiality.

• Report any actual or suspected data breach immediately as set out in section 6.

5. Data subject rights

Individuals have rights of access, rectification, erasure, restriction, objection and data portability. Any request engaging these rights, including a subject access request, must be passed to the Head of Compliance on the day it is received. The Company responds within one calendar month unless a lawful extension applies. Subject access request records are held in the Subject Data Access Requests library.

6. Personal data breaches

A personal data breach is any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Any actual or suspected breach must be reported to the Head of Compliance immediately upon discovery.

The Head of Compliance assesses the breach and, where it is likely to result in a risk to the rights and freedoms of individuals, notifies the ICO without undue delay and within 72 hours of becoming aware of it. Where the breach is likely to result in a high risk to individuals, the affected individuals are informed without undue delay. Every breach, whether or not notified, is recorded on the breach register with the facts, effects and remedial action taken.

7. International transfers

Personal data must not be transferred outside the UK unless appropriate safeguards are in place in accordance with data protection legislation, such as UK adequacy regulations or standard contractual clauses with the UK addendum.

8. Monitoring, training and enforcement

The Company may monitor the use of its systems, including email and internet usage, where lawful and proportionate, to ensure compliance with this policy, protect business interests and maintain security, as set out in the Employee Privacy Notice.

The Company provides data protection training to all staff and records completion in the training register. Any breach of this policy may result in disciplinary action and, depending on seriousness, could amount to gross misconduct.