Vulnerable Customer Policy

Recognising and responding to vulnerability in the people we deal with and in the data systems we build.

Document control
Reference	AM-POL-009
Version	1.0
Classification	Public
Owner	James Peachey, Co-founder
Approved by	James Peachey, Co-founder, on 2 June 2026
Next review	2 June 2027
Applies to	All amarti employees, contractors and associates
Standards alignment	Equality Act 2010; UK GDPR; ISO 9001:2015

1. Purpose

amarti is a business-to-business consultancy, but our work still reaches individuals, and some of those individuals are vulnerable.

Vulnerability matters to us in two distinct ways. First, the people we deal with directly (client contacts, associates, candidates and members of the public who get in touch) may be in circumstances that make it harder for them to engage with us. Second, and more significantly, the data platforms and pipelines we build for clients often process personal data about vulnerable individuals, and can influence decisions that affect them.

This policy sets out how we recognise vulnerability, how we adapt, and what we do to make sure the systems we build treat vulnerable people fairly.

2. Scope

This policy applies to all amarti employees, contractors and associates. It applies to direct interactions with individuals and to the design, build and support of client data systems.

amarti is not a regulated financial services firm and the FCA’s Consumer Duty does not apply to us directly. We use the FCA’s framework for identifying vulnerability because it is the clearest and most widely recognised in the UK, and because many of our clients are regulated firms who expect their suppliers to understand it.

3. What we mean by vulnerability

A vulnerable person is someone who, because of their personal circumstances, is especially susceptible to harm, particularly when an organisation is not acting with appropriate levels of care. Vulnerability is usually temporary and situational rather than a permanent label. It commonly arises from four drivers:

Driver	Examples
Health	Physical disability, sensory impairment, cognitive impairment, mental health conditions, serious or long-term illness, addiction.
Life events	Bereavement, relationship breakdown, job loss, caring responsibilities, domestic abuse, coercive control, leaving care, homelessness.
Resilience	Low or unstable income, over-indebtedness, no savings buffer, insecure housing, low emotional resilience.
Capability	Low literacy, numeracy or digital skills, limited English, low confidence managing personal or financial affairs, no access to reliable technology.

A person may be affected by more than one driver at once, and the same circumstance affects different people differently. We look at the situation in front of us rather than applying a checklist.

4. How we respond to individuals

If someone dealing with amarti tells us, or we reasonably believe, that they are in vulnerable circumstances, we will:

• Listen, take what they say at face value, and not ask them to repeat their circumstances unnecessarily.
• Adapt how we communicate: offer an alternative channel, allow more time, avoid jargon, confirm things in writing, or speak to a nominated representative where the individual has authorised it.
• Avoid pressure. We will not push for a decision or a response to a timescale that does not suit the person’s situation.
• Record only what is necessary, with the person’s knowledge. Information about health or disability is special category personal data under the UK GDPR and is handled accordingly, as described in the Privacy Policy (AM-POL-013).
• Signpost to appropriate external support where we are asked to, while being clear that amarti is not a support service and cannot give advice on health, debt, legal or welfare matters.
• Escalate to James Peachey immediately if there is any indication of risk of serious harm to the person or to someone else.

Reasonable adjustments for disabled people are made under the Equality Act 2010 as a matter of course, whether or not the person describes themselves as vulnerable.

5. Vulnerability in the systems we build

This is where a data engineering consultancy has the most influence. When we design, build or support a client system that processes personal data or supports decisions about individuals, we will raise the following with the client as part of our normal professional practice:

• Data minimisation. Whether every field being ingested is genuinely needed, particularly special category data such as health data, and whether it can be pseudonymised or aggregated.
• Vulnerability flags. Where a client holds vulnerability indicators, how those are secured, who can see them, how long they persist, and whether they are used only to provide better support rather than to exclude or price against the individual.
• Fairness and bias. Where a pipeline feeds an automated or semi-automated decision, whether proxies for protected characteristics or vulnerability are present in the feature set, and whether outcomes have been tested across groups.
• Meaningful human involvement. Whether decisions with a significant effect on individuals have genuine human review, consistent with the safeguards in Articles 22A to 22D of the UK GDPR as amended by the Data (Use and Access) Act 2025.
• Accessibility. Where we build or influence a user-facing interface, whether it meets WCAG 2.2 Level AA, works with assistive technology, and does not depend on a single channel.
• Error and complaint handling. Whether an individual can realistically get an error in their data corrected, and how that route is surfaced.
• Testing data. Real personal data relating to vulnerable individuals must never be used in non-production environments. We use synthetic or properly masked data, as required by the Information Transfer Policy (AM-POL-015).

Where a client instructs us to proceed in a way we believe creates a foreseeable risk of harm to vulnerable individuals, we will set out our concern in writing to the client. If the concern is not resolved, it is escalated to James Peachey under the Risk Escalation Policy and Procedure (AM-POL-010), and amarti may decline to carry out that part of the work.

6. Training and awareness

All amarti people receive vulnerability awareness as part of induction, covering the four drivers, how to adapt communication, the limits of our role, and how to escalate. Consultants working on engagements that process personal data receive additional briefing on the data-design considerations in section 5. Awareness is refreshed at least every two years.

7. Records, monitoring and review

Any adjustment made for a vulnerable individual, and any concern escalated under section 5, is recorded in the engagement record. James Peachey reviews these at each quarterly leadership review, looking for recurring themes rather than individual cases.

Concerns about how amarti has treated a vulnerable person can be raised through the Customer Complaint Procedure (AM-PRO-001) or directly with James Peachey at james@amarti.io. This policy is reviewed at least annually.

Questions about this document

The first point of contact for this document is James Peachey (james@amarti.io). Where a query is best handled by another member of the leadership team, it will be routed as follows:

Contact	Area	Email
Ben Alexander, Co-founder	Sales, client engagement and consultant operations	ben@amarti.io