CUSTOMER PRIVACY NOTICE - GARSTANG MORTGAGES LIMITED

About this Privacy Notice

This Privacy Notice explains what personal information we collect, how we use it, why we use it, who we share it with, how long we keep it and what rights you have under data protection law.

It applies to customers, prospective customers, website users, complainants and other individuals whose personal information we process in connection with our mortgage, protection and related financial services.

Who we are and how to contact us

Darren Hopkinson is responsible for deciding how and why your personal information is used. This means we are the data controller for the personal information described in this notice, unless we tell you otherwise.

  • Post:- 13 Catterall Gates Lane, Catterall, Preston, Lancashire, PR3 1YH

  • Telephone:- 07739466352

  • Email:- darren@garstangmortgages.co.uk

  • Data Protection Contact:- Darren Hopkinson

  • FCA Firm Reference Number:- 1006758

  • ICO Registration Number:- ZB623665

What information we collect, use and why

We only collect and use personal information where we have a lawful reason to do so. The information we use will depend on the service you ask us to provide and your circumstances.

Purpose:- Providing mortgage, protection and related financial services

Information we may use:- Name, contact details, address, date of birth, employment details, income, expenditure, financial commitments, credit history, property details, family or dependant information, policy needs, application details, lender or insurer decisions, correspondence, call recordings, client notes and documents you provide.

Lawful Basis:- Contract, legal obligation and legitimate interests.

Purpose:- Protection, insurance and related advice

Information we may use:- Information about your health, lifestyle, smoker status, occupation, family history where relevant, financial needs, existing cover and application answers.

Lawful Basis:- Contract, legal obligation, legitimate interests and explicit consent where special category health information is used.

Purpose:- Identity, fraud, sanctions, anti-money laundering and financial crime checks

Information we may use:- Name, contact details, date of birth, address history, identification documents, bank details, source of funds information, credit reference information, fraud prevention information and information from public sources.

Lawful Basis:- Legal obligation and legitimate interests.

Purpose:- Service updates and customer communications

Information we may use:- Name, contact details, case information, service preferences, correspondence history and communication records.

Lawful Basis:- Contract, legal obligation and legitimate interests.

Purpose:- Marketing and relationship management

Information we may use:- Name, contact details, marketing preferences, enquiry information, website interaction information and records of consent or opt-out.

Lawful Basis:- Consent or legitimate interests, depending on the type of communication and applicable marketing rules.

Purpose:- Dealing with queries, complaints or claims

Information we may use:- Name, contact details, case records, advice records, call recordings, correspondence, complaint details, financial information, health information where relevant, investigation notes and outcome records.

Lawful Basis:- Legal obligation and legitimate interests. Explicit consent or legal claims may apply where special category information is used.

Purpose:- Legal, regulatory, audit and reporting requirements

Information we may use:- Information required to meet FCA, HMRC, anti-money laundering, complaint handling, record keeping, audit, professional indemnity and other legal or regulatory requirements.

Lawful Basis:- Legal obligation and legitimate interests.

Purpose:- Website, cookies and similar technologies

Information we may use:- Device information, browser information, IP address, pages visited, cookie preferences, user journeys, form interactions, accessibility settings and changes you make while using the website.

Lawful Basis:- Consent, legitimate interests, or a PECR/DUAA exception where applicable. See the separate Cookie Policy for more information.

Special category and criminal offence information

Some personal information is treated as more sensitive under data protection law. This includes information about health, medical history, lifestyle and other special category information.

We may collect or use health information where it is necessary for protection or insurance advice, quotes, applications, underwriting, claims support, complaint handling, legal claims or regulatory requirements. We will only use this information where we have a valid lawful basis and a special category condition, such as your explicit consent, where required, or where the information is needed for legal claims or regulatory purposes.

We may also process information relating to suspected fraud, sanctions, financial crime, criminal offences or allegations where this is necessary and permitted by law, for example to comply with anti-money laundering requirements or to protect customers, the firm and others from fraud or financial crime.

We should only list special category or criminal offence data in this notice where the firm actually collects or uses it. Genetic information should not be included unless the firm genuinely receives or processes that information.

Lawful bases and your data protection rights

Under UK data protection law, we must have a lawful basis for collecting and using your personal information. The lawful basis we rely on may affect which rights apply.

Contract:- We need to use the information to enter into or perform a contract with you, or to take steps at your request before entering into a contract.

Legal obligation:- We need to use the information to comply with a legal or regulatory obligation.

Legitimate interests:- We use the information because it is necessary for our legitimate interests, or those of another organisation, and we have balanced this against your rights and freedoms.

Consent:- You have given us clear permission to use your information for a specific purpose. You can withdraw consent at any time.

Legal claims:- In limited cases, we may need to use information to establish, exercise or defend legal claims.

Your rights

You have rights under data protection law. These rights are not absolute and may not apply in every situation. We will explain if an exemption applies.

  • Right of access - you can ask for a copy of your personal information.

  • Right to rectification - you can ask us to correct information you think is inaccurate or incomplete.

  • Right to erasure - you can ask us to delete your personal information in certain circumstances.

  • Right to restriction - you can ask us to limit how we use your personal information in certain circumstances.

  • Right to object - you can object to us using your personal information in certain circumstances, including where we rely on legitimate interests or use your information for direct marketing.

  • Right to data portability - you can ask us to transfer personal information you gave us to another organisation, or to you, in certain circumstances.

  • Right to withdraw consent - where we rely on consent, you can withdraw that consent at any time.

  • Rights relating to automated decision-making - you have rights where decisions are made solely by automated means and have legal or similarly significant effects.

We will respond to data protection rights requests without undue delay and in any event within one month, unless the law allows us to extend the time because the request is complex or we have received multiple requests.

Your right to object: If you object to direct marketing, we will stop using your personal information for that purpose. If you object to other processing based on legitimate interests, we will consider your request and explain our decision.

To make a data protection rights request, please contact us using the contact details in section 2.

Where we get personal information from

  • Directly from you, including forms, applications, documents, calls, emails and meetings.

  • Advisers, appointed representatives, introducers or other parties involved in your enquiry or application.

  • Lenders, insurers, mortgage clubs, protection providers, surveyors, solicitors, estate agents and professional advisers.

  • Credit reference agencies, fraud prevention agencies, sanctions screening providers and identity verification providers.

  • Publicly available sources, such as Companies House, the Land Registry, the electoral register or public registers where relevant.

  • Our website, cookie banner, online forms and system providers.

Who we share personal information with

We may share personal information where it is necessary, lawful and proportionate. This may include sharing with:

  • lenders, insurers, mortgage clubs, protection providers and product providers;

  • appointed representatives, advisers, administrators and other parties involved in providing the service;

  • credit reference agencies, fraud prevention agencies, identity verification providers and sanctions screening providers;

  • solicitors, conveyancers, surveyors, accountants, estate agents and professional advisers where relevant;

  • IT providers, CRM providers, case management systems, secure document platforms, email and communication providers;

  • auditors, consultants, compliance support providers and professional indemnity insurers;

  • regulators, the FCA, the Financial Ombudsman Service, the Financial Services Compensation Scheme, HMRC, law enforcement bodies and other public authorities where required;

  • other parties where you have asked us to share information or where we are legally required or permitted to do so.

How long we keep information

We will keep personal information only for as long as necessary for the purposes described in this notice, including to meet legal, regulatory, complaint handling, professional indemnity, audit and record keeping requirements.

Mortgage, protection and related advice records:- Usually kept for at least 6 years after the end of the customer relationship, case closure or policy/application end, and longer where required for regulatory, complaint, claim, audit or professional indemnity purposes.

Protection policy and underwriting records:- May be kept for the life of the policy and for a further period after the policy ends, where necessary to support complaints, claims, regulatory requirements or legal claims.

Complaints and dispute records:- Usually kept for at least 6 years after the complaint is closed, and longer where necessary for ongoing regulatory, legal or ombudsman matters.

AML, identity and financial crime records:- Usually kept for 5 years after the end of the business relationship or transaction, unless a longer period is required or permitted by law.

Marketing records and preferences:- Kept until you withdraw consent, object, opt out, or the information is no longer needed. Suppression records may be kept to make sure we respect your choices.

Website and cookie information:- Kept in line with the duration shown in the Cookie Policy or cookie banner.

General enquiries that do not proceed:- 12 months, unless a longer period is needed.

Marketing

We may send you marketing or information about relevant services where we have your consent or where the law allows us to do so. You can opt out of marketing at any time by using the unsubscribe option in the communication or by contacting us.

We will not sell your personal information to third parties for their own marketing purposes.

Automated decision-making and profiling

We do not make decisions about you that are based solely on automated processing and that have legal or similarly significant effects, unless we tell you separately and the law allows us to do so.

Lenders, insurers, credit reference agencies and fraud prevention agencies may use automated checks or scoring as part of their own processes. Where they are independent controllers, their own privacy notices will explain how they use your information.

Website, cookies and similar technologies

When you use our website, we may collect information through cookies and similar technologies. This may include device information, browser information, IP address, pages visited, user journeys, cookie preferences, accessibility settings and changes you make while using the website.

Some cookies are necessary for the website to work. Other cookies or similar technologies may require consent, unless a PECR exception applies. Further information is set out in our separate Cookie Policy.

How to complain

If you have concerns about how we use your personal information, you can make a data protection complaint to us using the details below.

Email:- Complaints@themoney-group.co.uk

Telephone:- 01709 242927

Post:- 27 Bridgegate, Rotherham, South Yorkshire, S60 1SN

We will acknowledge receipt of a data protection complaint within 30 days. We will take appropriate steps to investigate and respond without undue delay, and we will keep you informed where appropriate.

This is separate from any complaint you may have about regulated financial services. If your complaint relates to advice, service, a product, or financial loss, it may also need to be handled under our financial services complaints procedure.

If you remain unhappy with how we have used your personal information after raising a complaint with us, you can complain to the ICO:

Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in how we use personal information, changes to our services, changes to law or regulation, or changes to ICO guidance. Where changes are material, we will take appropriate steps to bring them to your attention.

About this Cookie Policy

This Cookie Policy explains how we use cookies and similar technologies on our website. It should be read alongside our Privacy Notice.

Cookies and similar technologies may store information on your device or access information already stored on your device. Where the information is personal data, the UK GDPR and Data Protection Act 2018 also apply.

What are cookies and similar technologies?

Cookies are small text files placed on your computer, smartphone, tablet or other device when you visit a website. Similar technologies may include tracking pixels, scripts, tags, web storage, device identifiers, link decoration, fingerprinting techniques or other technologies that store information on, or access information from, your device.

Why we use cookies

We use cookies and similar technologies for different purposes. Some are necessary for the site to function, some help improve the performance of the site, some remember your choices to provide enhanced features, and some may help provide a more personalised or targeted experience by gathering information about browsing habits.

Cookies may also help record or remember changes you make when using the site, such as updates to your preferences, choices, forms, settings, accessibility options or other information you provide. This helps ensure the site functions correctly, that your choices are applied, and that we can improve the overall user experience.

Consent, PECR and DUAA exceptions

Under PECR, cookies and similar technologies usually require consent unless a legal exception applies. The Data (Use and Access) Act updated the rules for storage and access technologies and introduced additional exceptions in certain circumstances.

Where we rely on an exception, we will provide clear information about the technology and the purpose. Where the statistical purposes or appearance/functionality exception is used, we will also provide a simple, free way for you to object.

Where cookies or similar technologies are used for advertising, profiling, cross-site tracking, remarketing, or other targeting/marketing purposes, we will ask for your consent before using them.

Types of cookies we use

Strictly necessary cookies

These cookies are required for the website to work. They may be used to enable core functionality such as security, network management, page navigation, online forms, remembering cookie preferences and access to secure areas of the website.

These cookies cannot usually be switched off through our website because they are necessary for the website to function. You may be able to block them through your browser settings, but some parts of the website may not work properly if you do so.

Analytical/performance cookies

These cookies help us understand how visitors use our website. They may allow us to count visits, understand traffic sources, see which pages are most and least popular, and improve the performance and customer experience of the site.

Where analytical cookies are used only for aggregate statistical purposes to understand how our website is used and to improve the website or service, we may rely on the statistical purposes exception. Where we rely on this exception, the information must not be used to identify, track, profile or target you, and you must be given clear information and a simple, free way to object.

Where analytical or performance cookies are used for advertising, profiling, cross-site tracking or wider marketing purposes, we will ask for your consent before using them.

Functionality/appearance cookies

These cookies allow the website to provide better functionality and personalisation. They may be used to remember choices you make, such as preferences, settings, accessibility choices, display choices, language preferences, information you have updated or changes you have made when using the site.

Where these cookies are used only to adapt the appearance or functionality of the website in line with your preferences, we may rely on the appearance/functionality exception. Where we rely on this exception, we will provide clear information and a simple, free way to object.

Targeting/marketing cookies

These cookies and similar technologies may be used to personalise content, measure advertising, or build a profile of your interests. They may also track visits across websites or help show relevant content or advertising.

We will ask for your consent before using targeting or marketing cookies. These cookies are not treated as strictly necessary and are not covered by the statistical or appearance exceptions where they are used for advertising, profiling, cross-site tracking or marketing purposes.

Third-party cookies

Some cookies or similar technologies may be set by third parties that provide services to us, such as analytics providers, website service providers, embedded content providers, security tools or marketing platforms.

Where third-party cookies are used, we will provide information about the relevant third parties where required and explain the purpose of those cookies. Where consent is required, we will ask for your consent before those cookies are used.

Cookie categories and choices

Strictly necessary:- Required for the website to work, remain secure, remember cookie choices, support forms or provide a requested service. May be used without consent where the strictly necessary or communication exception applies. Cannot usually be switched off through the website. Browser blocking may stop the site working properly.

Analytical / performance:- Helps us understand website usage and improve the site. Consent is required unless the statistical purposes exception applies and the use is limited to aggregate statistical improvement. You can consent, reject or object where the exception is relied on.

Functionality / appearance:- Remembers choices and adapts site appearance or functionality. Consent is required unless the appearance exception applies. You can consent, reject or object where the exception is relied on.

Targeting / marketing:- Supports advertising, profiling, content personalisation or cross-site tracking. Consent is required. You can accept or reject these cookies through the cookie banner/settings tool.

Third-party:- Supports services provided by third parties, such as analytics, embedded content or security tools. Depends on purpose. Consent is required where no exception applies. You can manage choices through the cookie banner/settings tool where available.

Cookies we use

crumb:- Squarespace sets this cookie to prevent cross-site request forgery (csrf), strictly necessary, duration session

ss_cvr:- Squarespace sets this cookie to identify unique visitors and track a visitor’s session on a site, analytical/performance, duration 1 year 1 month 4 days, statistical exception

ss_cvt:- Squarespace sets this cookie to identify unique visitors and track a visitor’s session on a site, analytical/performance, duration 1 hour, statistical exception

Google Analytics and similar analytics tools

If we use Google Analytics or similar analytics tools, we will explain this in the cookie table. Analytics cookies may only rely on the statistical purposes exception where the use is genuinely limited to aggregate statistical information used to improve the website or service and is not used for advertising, profiling, cross-site tracking or individual-level monitoring.

To opt out of being tracked by Google Analytics across all websites, you can visit: http://tools.google.com/dlpage/gaoptout

How to manage cookies

When you visit our website, you may be shown a cookie banner or pop-up that allows you to manage your cookie choices. You can choose whether to accept or reject non-essential cookies and you may be able to manage your preferences by cookie category.

You may deny consent to the placing of cookies unless those cookies are strictly necessary or another legal exception applies. However, certain features of our website may not function fully or as intended if cookies are disabled.

Where we rely on the statistical purposes or appearance/functionality exceptions, you will be provided with clear information and a simple, free way to object to that use.

You can also modify your browser settings so that it notifies you when cookies are sent to your device. This allows you to manage the cookies that are set when using this website.

You can refuse cookies altogether through your browser settings. However, in doing so, you may not be able to use the website at all, or some parts of the website may not work properly.

For more information on cookies and how to manage them, please visit www.allaboutcookies.org or www.aboutcookies.org.

Changes to this Cookie Policy

We may update this Cookie Policy from time to time to reflect changes in the cookies and similar technologies we use, changes to our website, changes in law or regulation, or changes to ICO guidance.

Where changes are material, we will take appropriate steps to bring those changes to your attention.