Privacy and Fair Processing Notice
LAST UPDATED 25/05/2023
This Privacy and Fair Processing Notice contains important information about how we collect and use personal information about you and explains your rights in relation to your personal data.
About The Mortgage Lender and how to contact us
The Mortgage Lender Limited is a wholly owned subsidiary of Shawbrook Bank Limited, with it’s own separate legal and regulatory status. We are registered as a data controller with the Information Commissioners Office (ICO) under registration number ZA136175.
If you have any queries relating to our use of your personal information or any other related data protection questions, please contact us by writing to:
Data Protection Officer
The Mortgage Lender Limited
PO Box 27135
By email: email@example.com
Or by telephone 0344 257 0428
This Privacy and Fair Processing Notice applies to anyone who directly or through a mortgage intermediary or other authorised third party;
- Asks us to consider if we would grant them a loan (known as a decision in principle)
- Applies to us for a mortgage loan
- Applies to be added to an existing loan
- Applies to guarantee a loan with us
- Has their data captured as part of the application process or administration of the loan, e.g. has gifted a deposit to an applicant
- Is a director, company secretary, shareholder or partner in a limited company or Limited Liability Partnership (LLP) that applies for a loan with us
- Has or has held a mortgage with us, including anyone who is a director, company secretary, shareholder or partner in a limited company or limited liability partnership
- Has had their data captured as part of the administration of the loan e.g. if you are given permission by our borrower to discuss or manage their account on their behalf.
- Has registered as a mortgage intermediary or authorised user of our Intermediary Portal
Our Privacy Commitment to you
Your privacy is important to us, so we commit to process any personal information you share with us with your privacy in mind.
Any personal information shared with us will always be processed in accordance with relevant laws and regulations and we will only use the personal information you provide to deliver the services you have requested, or for our lawful, disclosed purposes. We will not make your personal details available outside of our group without your consent, unless obliged by law. We will never sell or rent your name or personal information to any third party without your permission.
Types of data we collect & process
We will collect personal information, including sensitive information from you, your mortgage intermediary and other third parties such as your employer, landlord, other lenders and financial institutions, HMRC and DWP. We may also use information available from publicly available directories and information sources such as social media, the internet and news articles.
The personal data you have provided, or we have received may include your;
- date of birth
- marital status
- your image, where you have provided your passport, driving license or other photographic identification
- residential address and address history
- contact details such as email address and telephone numbers
- financial information, including income, assets, loans and other liabilities along with the names of other creditors
- your bank account details, including balances and payments to and from your accounts
- employment details, including current and previous employers, length of employment, role, salary and tax code
- identifiers assigned to your computer or other internet connected device, including your Internet Protocol (IP) address
- the conduct of any existing or previous accounts you have with us or our group, or applications you have submitted
- financial associate’s accounts (or anyone financially linked with you)
- business accounts (if you are an owner, director or partner in a business).
If you give us false or inaccurate information and we suspect or identify fraud we will record this and may also pass this information to fraud prevention agencies and other organisations involved in crime and fraud prevention.
Data we receive from and share with third parties
In order to process your application, we will also perform credit and/or identity checks on you with one or more credit reference agency (“CRAs”).
If we have collected your information as part of a mortgage application, but you are not the applicant – for example you are providing a gifted deposit, we may perform identity checks on you with one or more CRA.
When you have a mortgage with us we may also make periodic searches at CRAs to manage your account.
To do this, we will supply your personal information to CRAs and they will give us information about you. This will include information from your credit application and about your financial situation and financial history. CRAs will supply to us both public (including the electoral register) and shared credit, financial situation and financial history information and fraud prevention information.
How we use this data
The information we collect and share will help us to;
- assess this and further applications from you or other members of your household for this and other products and services and to make decisions about any such application(s), agreement or correspondence which you may have with us;
- make lending decisions, to process mortgage applications, to obtain references and to administer mortgage accounts;
- verify the accuracy of the data you have provided to us;
- provide the services requested and manage the relationship between us;
- verify your identity as a donor or lender of deposit monies or as occupier of any security property to ensure that there is no conflict in respect of parties' rights over the relevant security property;
- process, obtain and check other information, manage your account and administer any product or services that we provide you with or at your request;
- perform obligations or exercise rights that we may have under any agreement with you;
- trace and recover debts;
- undertake market research, statistical and business analysis and create and maintain a customer profile;
- prevent, detect, prosecute or mitigate the consequences of fraud and money laundering or other crimes, trace debt and recover debt and comply with applicable law and regulations; and
- contact HM Revenue and Customs, Department for Work and Pensions, any lender, landlord, employer or professional adviser named on an application, to obtain information or confirm any income received, outstanding liabilities and payments made.
When we and the third parties we may share your data with, process this data, we do so on the basis that it is necessary for us to enter into or manage a contract with you. We also have a legitimate interest in preventing fraud and money laundering, and to verify identity in order to protect our business and to comply with laws that apply to us.
What credit reference agencies do when they receive a search from us:
When CRAs receive a search from us they will place a search “footprint” on your credit file whether or not an application proceeds. If the search was for a credit application the record of that search (but not the name of the organisation that carried it out) may be seen by other organisations when you apply for credit in the future.
The CRA will link together the records of you and anyone that you have advised is your financial associate including previous and subsequent names of parties to the account. Links between financial associates will remain on your and their files until such time as you or your partner successfully files for a disassociation with the credit reference agencies.
Your data may also be used by us or other third parties to offer you other products, but only if you have given your permission.
The identities of the CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail in the Credit Reference Agency Information Notice (CRAIN). You can obtain this from each of the three CRAs using the links below:
We will continue to exchange information about you with CRAs and Fraud Prevention Agencies, (if we determine that you pose a fraud or money laundering risk) while you have a relationship with us. We will also inform the CRAs about your settled accounts. If you borrow and do not repay in full and on time, CRAs will record the outstanding debt. This information may be supplied to other organisations by CRAs.
If you are making a joint application or tell us that you have a spouse or financial associate, we will link your records together, so you should make sure you discuss this with them and share with them this information, before lodging the application.
Other Third parties with whom we may share your data
We may also disclose your personal information to:
- Shawbrook Bank Limited and other group companies
- external Auditors, regulatory bodies and relevant authorities or bodies who have a legal right to access the information or whom you authorise us to give information to, including the Financial Ombudsman Service, The Prudential Regulation Authority and The Financial Conduct Authority;
- our funding partners;
- our Insurers;
- intermediaries, specialist distributors or mortgage clubs who send us applications or who you appoint in connection with any application to us;
- agents or third party contractors we appoint to administer or operate your account, including any person who may replace us in the administration of your account;
- solicitors and valuers acting for us;
- field agents and tracing agents;
- HMRC and the Department for Work and Pensions;
- The Insolvency Service and insolvency practitioners instructed by you;
- providers of information technology and communication services;
- data processors who act on our behalf or on behalf of any person who may be the beneficial owner of your loan; and
- market research organisations, for the purposes of confidential market research conducted on behalf of us.
We, and the third parties we share your data with, may also enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime.
Sending Data outside of the EEA (European Economic Area)
We will not routinely transfer any information about you outside of the EEA, however some of the third parties listed above may do so when completing tasks necessary for the performance of our contract or we may be required to send data to organisations outside of the EEA in order to collect information about you.
Where it is necessary to transfer your personal information to any other territories or countries outside the EEA, we will ensure that appropriate safeguards are in place to maintain the same levels of protection as are needed under data protection laws in the UK.
How long will we keep your personal data for ?
If you have a mortgage with us, we will keep your personal data for as long as you are our customer, and for up to 10 years after you are no longer a customer.
If you have applied for a mortgage with us or have had a mortgage with us in the past we may keep your data for up to 10 years.
If your details have been captured as part of a mortgage application or during the course of the administration of a mortgage, we may keep your data for up to 10 years after the application has been submitted or up to 10 years after the mortgage for which your details were captured, has redeemed.
We keep this data so that we can:
- Respond to any questions or complaints;
- Show that we treated our customers fairly;
- Maintain records according to rules that apply to us.
In some circumstances we may need to keep your data for longer than this, for example, if there are legal, regulatory or technical reasons. If we do, we will make sure that your privacy is protected and only use it for legitimate purposes.
Fraud prevention agencies can hold your personal data for different periods of time, and if you are considered to pose a fraud or money laundering risk, your data can be held for up to six years by them.
Automated decision making, profiling
We may use our systems to make automated decisions based on the personal data we have about you or your business. This helps us to make quick, fair and accurate decisions, based on what we know. These can affect the products we can offer you.
Our automated decisions may determine that you pose a fraud or money laundering risk if our processing reviews your behavior to be consistent with that of known fraudsters or money launderers, is inconsistent with your previous submissions, or if you appear to have deliberately hidden your true identity.
You can ask us that we do not make our decisions based on the automated system alone or, if you are unhappy with an automated decision, you can ask that a person reviews this. If you would like this reviewed, you should contact your Mortgage Intermediary in the first instance.
Criminal conviction and Special Category Data
We will only process personal data relating to criminal convictions or offences and alleged offences where the law permits us to do so e.g. to perform checks to prevent and detect crime and to comply with laws relating to money laundering, fraud, terrorist financing, bribery and corruption and international sanctions or where we have your consent to do so.
Data protection law defines certain types of information as ‘special category data’. This includes details about your health and medical conditions or biometric data. We will only process special category data where we have obtained your explicit consent to do so or another lawful basis exists, for example, where it is necessary for reasons of substantial public interest, namely to safeguard the economic well-being of individuals, preventing or detecting unlawful acts or preventing fraud.
Other consequences of Processing
If we or one of the third parties we share data with, determine that you pose a fraud or money laundering risk, we may refuse to provide the services, goods or financing you have requested, or to employ you, or we may stop providing existing services to you.
A record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services, financing or employment to you. If you have any questions about this, please contact us using the details at the start of this notice.
Under General Data Protection Regulation, you have certain rights to access the information we hold, to ask us to correct personal information that is wrong or incomplete and, in some circumstances, ask us to stop using or to delete your personal information. You can access the personal information we hold by writing to us, at the address given at the start of this notice
All communications with us may be monitored or recorded to improve the quality of our service, staff training and for your protection and security.
Ordinary email is not secure, and it may pass through servers in countries without data protection laws. For your own protection, we request that you do not include confidential or personal information in any emails you send to us.
If you are unhappy about how your personal data has been used please refer to our complaints leaflet www.themortgagelender.com/customer-documents/.
You also have a right to complain to the Information Commissioner's Office www.ico.org.uk which regulates the processing of personal data.
Information for mortgage intermediaries or other authorised users of our Intermediary Portal
By registering with us to use our mortgage portal, we will process your personal information and other information available to manage your relationship with us, to prevent and detect fraud, to comply with legal and regulatory requirements and for market research.
We may share your personal information with third parties who process on our behalf, including marketing & PR agencies, consumer review services and third-party IT providers. For further information about how we collect and use personal information about you and your rights in relation to your personal data, please contact us using the details at the start of this notice.
By registering a case with us, an intermediary is agreeing on behalf of the applicant(s) to the use of their personal information, including any sensitive personal information. Make sure you understand how we make use of applicant’s personal information together with the specific information you provide as part of the application and that the information provided is accurate.
You should only share applicants or their associates personal information with us where you have shown them a copy of this privacy notice and obtained their confirmation that they know you will share it with us for the purposes described (and where you have their consents, as relevant, for the processing described).
We recommend that you check this page regularly, as from time to time we will review and update these policies. Any changes we make to the policies published here will be effective immediately.
Version 1.1 May 2023