Privacy notice

This notice explains how I use the business contact details of firms I write to, and how this website handles your visit.

Who I am

Gabriele Affinito, trading as Plain Record, Via Ottavio Colecchi 2, 80011 Acerra (NA), Italy, gabriele@plainrecord.co.uk.

I prepare compliance documentation for UK financial advice firms. I am the controller of the information described here.

Because I am established in Italy, both the EU GDPR and the UK GDPR apply to what I do with your information.

What information I hold, and where it comes from

I hold your firm's name and FCA reference number, your firm's status as shown on the FCA Register, and the business email address your firm publishes on its website.

Where that address identifies an individual, it is personal data. I obtained it from your firm's website and from the FCA Register, both publicly accessible.

Why I use it, and on what basis

I use it to contact your firm about my compliance documentation service.

The legal basis is my legitimate interests (Article 6(1)(f) of the UK GDPR and of the EU GDPR). My interest is in offering a service relevant to your firm's business. It is balanced against your interests in my legitimate interests assessment, which you can ask to see.

If you write to me

If you email me, I use your email address and what you write, including how you found Plain Record if you choose to say, to reply to you and to keep a record of our correspondence. The legal basis is my legitimate interests in answering you (Article 6(1)(f) of the UK GDPR and of the EU GDPR). Writing to me does not put you on a mailing list.

Who receives it, and where it is held

These providers process it on my behalf: Google Workspace, for my email; Hunter, the tool I use to send my emails to firms; and a cloud storage provider that holds my working records. If you book a call with me, the booking service Calendly receives the name, email address and firm details you enter. No one else receives it.

Your information leaves the UK. I am established in Italy, which UK law recognises as providing adequate protection.

• Google: my contract is with Google in Italy. Where Google processes data outside the UK and the European Economic Area, its data processing terms rely on standard contractual clauses or another recognised transfer mechanism.
• Hunter: its servers are in Belgium. Where it transfers data elsewhere, it relies on standard contractual clauses and the UK International Data Transfer Agreement.
• The storage provider for my working records, Calendly and Cloudflare are in the United States. Each is certified under the EU-U.S. Data Privacy Framework and its UK Extension.

How long I keep it

If your firm buys from me, I keep our correspondence and the records of the engagement for six years after the engagement ends. That is the period in which a claim under the contract could be brought.

Otherwise, I delete your information 12 months after our last contact, whether you wrote to me or I wrote to you. If we have never been in contact, I delete it 12 months after I obtained it. This includes the copies in the version history of my working records.

If you ask me not to contact you again, I keep only what I need to make sure I don't.

Your rights

You can ask for access to the information, its correction or erasure, or the restriction of its use. You can object to my use of it on the basis of my legitimate interests.

You have the right to object to my use of your information for direct marketing at any time. If you object, I will stop.

Any request not to be contacted again, in whatever words, is treated as an objection. So is a reply whose meaning is unclear. It applies to every address I send from, not only the one that wrote to you.

A reply that only declines the current offer, such as "not now" or "already covered", is not treated as an objection.

How to complain

You can complain to me first, by replying to any of my emails or by writing to gabriele@plainrecord.co.uk.

I will acknowledge your complaint within 30 days of receiving it, look into it, and tell you the outcome without undue delay.

You can also complain to the Information Commissioner's Office at ico.org.uk (this link leaves this website).

You can also complain to the Italian supervisory authority, the Garante per la protezione dei dati personali, at garanteprivacy.it (this link leaves this website).

Automated decisions

None.

This website

This website sets no cookies, stores nothing on your device and uses no analytics. It loads nothing from other websites.

The site is served by Cloudflare. To deliver the pages and protect the site from attacks, Cloudflare processes technical information about each visit, such as your IP address, on my behalf. I do not keep a log of visits.

Changes to this notice

Last updated: 5 October 2026.