Privacy Policy

Mainly Mortgages takes your privacy seriously and takes every reasonable precaution to safeguard the personal information you supply to us. We recognize that your privacy and the protection of your personal information are important to you. This statement discloses how Mainly Mortgages helps to protect your personal information.

Mainly Mortgages Ltd is registered with the Information Commissioner’s Office (ICO) under registration number ZA748617.

To find out more information about data protection, you can visit: www.ico.org.uk

Mainly Mortgages Ltd uses Acre (www.acresoftware.com) as its Customer Relationship Management (CRM) systemto collect client information and store documents in order to provide mortgage services. This Privacy Statement extends to Acre as well.

Data Protection Policy

Why this Policy Exists

This data protection policy ensures Mainly Mortgages:

Complies with data protection law and follows good practices.

Protects the rights of individuals and their personal data.

Is transparent about how it stores and processes personal data.

Protects itself from the risks of a data breach.

Data Protection Law

Mainly Mortgages adheres to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, which outline the lawful handling of personal information. These rules apply to both electronic and physical data storage.

To comply with the law, personal information must be:

Processed lawfully, fairly, and transparently.

Collected for specific, explicit, and legitimate purposes.

Adequate, relevant, and limited to what is necessary.

Accurate and, where necessary, kept up to date.

Retained only for as long as necessary for its purpose.

Securely processed to prevent unauthorized access, loss, or damage.

Record Keeping

Mainly Mortgages maintains internal records of processing activities, including:

Purpose of data processing.

Categories of personal data and individuals affected.

Data transfers to third parties.

Retention schedules and security measures.

Mainly Mortgages retains client data for six years in line with the Financial Conduct Authority’s (FCA) record-keeping rules. After this period, personal data is anonymized and retained only for statistical purposes.

Lawful Basis for Processing Data

Mainly Mortgages processes personal data under the following lawful bases:

Consent: When an individual provides explicit consent for a specific purpose.

Contract: When processing is necessary to fulfill a contract (e.g., providing a mortgage quote or submitting an application).

Legal Obligation: When processing is required to comply with legal requirements (e.g., anti-money laundering regulations).

Special Categories of Data: Mainly Mortgages may collect sensitive data such as:

Ethnic origin

Health information (for insurance or affordability assessments)

Other relevant data required by mortgage lenders

This data is only processed with a valid lawful basis and additional safeguards.

Automated Decision-Making & Third-Party Processing

Mainly Mortgages does not directly conduct automated decision-making or profiling. However, lenders to whom we refer applications may use automated systems to assess affordability and eligibility. Clients are encouraged to review lender-specific privacy policies for more information on their automated decision-making practices.

Responsibilities

Mainly Mortgages acts as a Data Controller and Data Processor. While we have not appointed a Data Protection Officer (DPO), the Directors are responsible for ensuring compliance with UK GDPR.

A Data Protection Impact Assessment (DPIA) is conducted when adopting new technologies or processing activities that may pose risks to individual privacy.

Individuals’ Rights

Under UK GDPR, individuals have the right to:

Be informed about how their data is processed.

Access their personal data.

Rectify inaccurate or incomplete data.

Erase personal data (where applicable).

Restrict processing in certain circumstances.

Data portability for electronically processed data.

Object to data processing.

Withdraw consent at any time where consent is the basis for processing.

Mainly Mortgages provides clients with a Privacy Notice at the point of data collection, detailing how their data is processed.

Subject Access Requests (SAR)

Individuals may request access to their personal data. Mainly Mortgages provides this information free of charge within one month. If the request is complex, we may extend this by an additional two months.

Data Security & Storage

Mainly Mortgages implements the following security measures:

Electronic Data:

Protected by strong passwords and encryption.

Stored securely in Acre’s cloud-based platform.

Regularly backed up and monitored.

Physical Data:

Stored in locked cabinets with limited access.

Securely shredded when no longer required.

Data Transfers:

Data is not transferred outside the UK unless necessary safeguards are in place.

Personal data is never shared informally or via unsecured email.

Complaints & Contact Information

If you have concerns about how Mainly Mortgages processes your data, you can contact us at:

Mainly Mortgages
Regent House Business Centre, 13-15 George Street, Aylesbury, HP20 2HU
Email: privacy@mainlymortgages.co.uk

If you are unsatisfied with our response, you may lodge a complaint with the Information Commissioner’s Office (ICO):
www.ico.org.uk/make-a-complaint/

Changes to This Privacy Policy
Mainly Mortgages will periodically update this Privacy Policy. When updates are made, the “Last Updated” date at the top of this document will be revised. If significant changes affect how we process your data, we will notify you and request consent where necessary.

Last Updated: March 2025