Terms & Conditions

1. About these Terms

These Terms & Conditions ("Terms") form a binding agreement between 3M Financial Ltd (company number 17128047, registered office 62 Cotham Drive, Wakefield, England, WF2 7BS) ("3M Financial", "we", "us") and the FCA-authorised firm whose adviser registers for an account on the 3M Financial adviser portal (the "Firm", "you").

By ticking the acceptance boxes during registration, the adviser confirms they are authorised to bind the Firm to these Terms and to the incorporated Data Processing Agreement (see clause 6).

2. The Service

3M Financial provides outsourced administration and paraplanning support to UK financial advisers via a secure web portal (the "Service"). The Service is a temporary processing pipeline for active casework; it is not a regulatory archive or a backup system for the Firm's client data.

3. Acceptable Use

You agree that you and your advisers will not:

• upload or transmit any file containing malware, viruses, ransomware or other malicious code;
• attempt to scrape, crawl, reverse-engineer or otherwise extract bulk data from the Service;
• share, resell, sublicense or otherwise transfer login credentials, or allow any third party to access the Service under your account;
• use the Service to store data unrelated to active casework, or as your Firm's primary regulatory record;
• interfere with the Service's security, availability or integrity, or attempt to circumvent access controls including Multi-Factor Authentication ("MFA");
• upload personal data of any data subject other than as strictly necessary for the case being processed.

We may suspend or terminate access immediately where we reasonably believe this clause has been breached.

4. Account Security

You are responsible for maintaining the confidentiality of adviser credentials, for keeping MFA enrolled on every account, and for notifying 3M Financial without undue delay (and in any event within 24 hours) if you suspect that an account has been compromised.

5. Data Retention

Once a case is marked as Completed, supporting files, client documents, policy numbers, asset values and any other special category data are permanently deleted from the portal 30 days later. A minimal commercial record (adviser name, client name, IFA firm name, case cost and case reference number) is retained for 6 years plus the current financial year to satisfy our own statutory and regulatory obligations.

The Firm is responsible for downloading and storing any documents it requires for its own regulatory record within the 30-day window.

Issued invoices are excluded from the 30-day deletion. Invoices issued through the portal (which show the client name, case reference, case type and fee) form part of our statutory financial records and are retained for 6 years plus the current financial year, in line with HMRC record-keeping requirements.

6. Data Processing Agreement (incorporated)

By ticking the acceptance boxes at registration, the parties mutually execute 3M Financial's standard Data Processing Agreement ("DPA"), which is incorporated into these Terms by reference and which records that:

• the Firm is the Data Controller and 3M Financial is the Data Processor in respect of all personal data uploaded to the Service;
• processing is carried out only on the documented instructions of the Firm, for the purpose of providing the Service;
• all data is encrypted in transit (TLS 1.2+) and at rest, and hosted in the United Kingdom or European Economic Area;
• we will notify the Firm without undue delay, and in any event within 72 hours, of becoming aware of any personal-data breach affecting Firm data;
• sub-processors are limited to the infrastructure providers strictly required to operate the Service;
• on termination, data is deleted in line with clause 5.

A standalone signed copy of the DPA is available on request to Jessica@3mfinancial.co.uk.

6a. Firm-managed Staff Accounts

An adviser may invite in-house admin or support staff to the portal from within their account. The Firm acknowledges that:

• the Firm is solely responsible for the staff accounts it creates, including who is invited, what they access, and removing accounts promptly when staff leave;
• each staff member must set their own password and enable Multi-Factor Authentication, and is bound by clauses 3 and 4 of these Terms;
• the inviting adviser cannot view, reset or bypass a staff member's password or MFA settings. These are personal security credentials managed by the staff member alone;
• 3M Financial will not action a request from an adviser to disclose or reset another user's authentication credentials.

6b. 3M Financial Administrator Access

A small number of 3M Financial personnel hold an "administrator" role with elevated access required to operate the Service (approving advisers, setting case costs, support). The administrator role is granted only by an existing administrator following an explicit confirmation step, and every grant or revocation is recorded. Administrators are still bound by the confidentiality and security obligations in the incorporated DPA.

6c. Audit Rights (FCA Outsourcing)

We recognise that the Firm is regulated by the Financial Conduct Authority and is subject to the FCA's outsourcing requirements (SYSC 8). To support the Firm's compliance with those rules:

• the Firm may, on reasonable prior written notice, inspect or audit our data management and security procedures as they relate to the Firm's data, at the Firm's cost and no more than once in any 12-month period unless a material issue is identified;
• we will cooperate with the Firm's regulator, including the FCA, and provide it with reasonable access to information about the Service to the extent it relates to the Firm's use of the Service;
• audits and inspections will be carried out in a way that protects the confidentiality and security of other firms' data.

6d. Exit & Data Return

If the agreement ends for any reason, we will, at the Firm's request, export and provide back to the Firm all active case files, notes and case records held on the portal in a standard machine-readable format (for example ZIP and CSV/JSON) before they are deleted. Data is then deleted in line with clause 5. The Firm should raise any export request promptly, as completed cases remain subject to the 30-day deletion of special-category data described in clause 5.

7. Limitation of Liability

Nothing in these Terms limits liability for death or personal injury caused by negligence, for fraud, or for any other liability that cannot lawfully be excluded.

Subject to that, and to the maximum extent permitted by law:

• 3M Financial shall not be liable for any indirect, special or consequential loss, or for any loss of profit, revenue, goodwill, anticipated savings, business opportunity or data;
• 3M Financial shall not be liable for any regulatory fine, FCA enforcement action, professional-indemnity excess or business disruption suffered by the Firm or its clients arising from unexpected downtime, latency or temporary unavailability of the Service;
• our total aggregate liability in any 12-month period shall not exceed the fees actually paid by the Firm to 3M Financial in that period.

The Firm acknowledges that the Service is a processing pipeline and that regulatory record-keeping remains the Firm's responsibility.

8. Suspension & Termination

Either party may terminate the agreement on 30 days' written notice. We may suspend access immediately where required for security, legal or regulatory reasons.

9. Governing Law

These Terms are governed by the laws of England & Wales and the parties submit to the exclusive jurisdiction of the courts of England & Wales.

10. Contact

Questions about these Terms can be sent to Jessica@3mfinancial.co.uk or Jamie@3MFinancial.co.uk. See also our Privacy Policy.