Privacy Policy

About This Notice

This privacy notice explains how Mortgage Decisions Ltd ("we", "us", "our") collects, uses, stores, and shares your personal data when you use our services, visit our website, or communicate with us. It also describes your rights under UK data protection law.

Mortgage Decisions Ltd is an appointed representative of Mortgage Advice Bureau Limited and Mortgage Advice Bureau (Derby) Limited, both authorised and regulated by the Financial Conduct Authority (FCA). This means we are subject to FCA rules, including those under the Consumer Duty, as well as the requirements of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Please read this notice carefully. By using our services, you acknowledge that you have read and understood how we handle your personal data. If you have any questions, please contact us using the details in Section 13.

This notice was last amended on June 2026 and supersedes all earlier versions. We may update this notice from time to time. Where changes are material, we will notify you by email or by a prominent notice on our website.

1. Who We Are

Data Controller: Mortgage Decisions Ltd

Registered Office: Trinity House, Winchester Road, Chandler’s Ford, Eastleigh, England, SO53 2DR

Data Protection Contact: Christie West

Email: c.west@mortgagedecisions.com

Postal Address: 123 Winchester Road, Chandlers Ford, SO53 2DR

FCA Registration: Appointed representative of Mortgage Advice Bureau Limited and Mortgage Advice Bureau (Derby) Limited (FCA registered).

For all data protection queries, subject access requests, or complaints, please use the contact details above.

2. What Personal Data We Collect

We collect and process only the minimum personal data necessary to deliver our services to you. This may include:

• Identity and contact information: your name, postal address, telephone number, and email address
• Financial information: details about your income, outgoings, existing credit commitments, and mortgage requirements
• Identity verification information: where required by the Money Laundering Regulations 2017 and Immigration Act, documents such as passport or driving licence
• Credit and affordability information: credit history and related data obtained in the course of assessing your mortgage or protection needs
• Bank details: where required, for example when processing refunds or payments
• Payment card details: entered directly into our payment system and not retained by us
• Communications: records of email, telephone (including call recordings), and SMS correspondence with us
• Website usage data: IP address, browser type, pages visited, and device information collected automatically when you use our website
• Marketing preferences: your choices about receiving information from us
• SMS and AI-assisted messaging data: records of text message conversations handled by our AI-assisted messaging system (see Section 9)
• Vulnerability or support needs: information you share that indicates you may need additional care or support, used solely to ensure we serve you appropriately

Where we are required by law or regulation to collect certain data and you do not provide it, we may be unable to provide the service you have requested. We will tell you if this situation arises.

3. How We Collect Your Personal Data

We collect personal data in the following ways:

• Directly from you: when you enquire about or apply for a mortgage or protection product, complete a form on our website, correspond with us by email, telephone, or SMS, or visit our offices
• From third parties: credit reference agencies, lenders, insurers, and other financial service providers in the course of arranging a product for you; our affiliated estate agency brands where you are also their customer
• Automatically: through cookies and similar technologies when you visit our website (see our separate Cookie Policy at www.mortgagedecisions.com/cookie-policy)

4. Why We Use Your Personal Data — Lawful Bases

Under the UK GDPR, we must have a lawful basis for every use of your personal data. The table below sets out the purposes for which we process your data and the legal basis we rely on for each.

Where we rely on legitimate interests, we have carried out or will carry out a Legitimate Interests Assessment (LIA) to confirm that our interests are not overridden by your rights and reasonable expectations. You have the right to object to processing based on legitimate interests at any time. See Section 11.

5. Who We Share Your Data With

5.1 Data Processors

We engage third-party service providers (“data processors”) who process data on our behalf under written contracts that meet the requirements of Article 28 UK GDPR. These include:

• Mortgage lenders and insurance providers: to whom we submit applications on your behalf
• Credit reference agencies: to assess affordability and verify identity
• IT, cloud hosting, and software providers: to operate our business systems securely
• Cloud SMS provider (Twilio Inc): to send and receive SMS text messages
• Cloud hosting provider (Amazon Web Services EMEA SARL, eu-west-2 London region): to securely store conversation and messaging data
• AI language model provider (OpenRouter Inc and the underlying model provider): to power our AI-assisted messaging system
• Call recording and telephony providers: to record and store call recordings

A full list of our data processors, including the countries in which they operate, is available on request.

5.2 Other Third Parties

We may also share your data with:

• Our network principal (Mortgage Advice Bureau) and its compliance functions, where required for regulatory oversight
• Affiliated estate agency brands within our group, where you are a customer of both and sharing is relevant to your service
• Solicitors, surveyors, accountants, and other professional advisers, where necessary to progress your transaction
• Regulatory bodies (FCA, ICO) and law enforcement, where we are required by law to disclose
• Prospective buyers or sellers of our business, in the event of a merger or acquisition, subject to confidentiality obligations

We do not sell your personal data to third parties. We do not share your personal data with third parties for their own marketing purposes without your prior consent.

6. International Transfers

Most of our processing takes place within the United Kingdom or the European Economic Area (EEA). Where processing takes place outside the UK (for example, where a processor operates data centres in the United States), we ensure that appropriate safeguards are in place, such as:

• The UK International Data Transfer Agreement (IDTA)
• Standard Contractual Clauses approved or adopted for use under UK law
• An adequacy decision made by the UK Secretary of State

Details of the safeguards in place for specific transfers are available on request.

7. How Long We Keep Your Data

We retain personal data for as long as necessary for the purpose for which it was collected, and to meet our legal, regulatory, and record-keeping obligations as an FCA-regulated firm.

As a guide:

Our full Data Retention Schedule is available on request.

8. Marketing Communications

We may contact you with information about mortgage and protection products and services that may be of interest to you. We do so by email, telephone, and SMS.

We rely on one of two bases for marketing to you by electronic means:

• Your consent: where you have specifically agreed to receive marketing from us (for example, when completing a registration or enquiry form)
• The PECR soft opt-in: where you are an existing customer, your contact details were collected in the course of a transaction with us, the marketing relates to similar products or services, and you were given a clear opportunity to opt out when your details were collected and in every subsequent message

You can opt out of marketing communications at any time by:

• Replying STOP to any SMS we send you
• Clicking the unsubscribe link in any marketing email
• Contacting us at c.west@mortgagedecisions.com or 03454 500200

Opting out of marketing will not affect service-essential communications, such as appointment confirmations or regulatory notices.

9. SMS Communications and AI-Assisted Messaging

9.1 SMS Communications

We may contact you by SMS in connection with the services you have requested or previously received from us. This may include:

• Reminders about upcoming mortgage product expiry dates
• Invitations to review your mortgage or protection arrangements
• Follow-ups on appointments, including missed or rescheduled appointments
• Responses to enquiries you have made
• Property-related updates where you are also a customer of one of our affiliated estate agency brands

You can opt out of SMS communications at any time by replying STOP to any message, or by contacting us as set out in Section 13.

9.2 AI-Assisted Messaging

Our AI-assisted messaging system works as follows:

• Messages may be drafted, sent, and replied to by an automated system operating on behalf of our team
• The system uses personal data about you — including your name, contact details, customer status, and previous interactions — to send relevant and timely messages
• If you reply to one of these messages, the system may respond automatically to answer general queries, book appointments, or route your message to a human colleague
• The AI system does not provide regulated financial advice. Any query requiring advice is passed directly to a qualified human adviser
• If you ask whether you are speaking to a person or an automated system, we will tell you honestly
• You can ask to speak to a human colleague at any point by replying to any message or calling us on 03454 500200
• A human colleague reviews all escalated or sensitive conversations

9.3 Lawful Basis for SMS and AI-Assisted Messaging

We process your personal data to send these communications under the following lawful bases:

• Legitimate interests (Article 6(1)(f) UK GDPR): where we have an existing customer relationship and contact you about products or services similar to those you have already received. Our legitimate interest is in maintaining the customer relationship and ensuring you receive timely information about your arrangements. We have balanced this against your rights and reasonable expectations.
• Consent (Article 6(1)(a) UK GDPR): where you have specifically agreed to receive marketing or informational SMS messages.
• Contract (Article 6(1)(b) UK GDPR): where the SMS is necessary to perform a service you have asked us to provide, such as confirming an appointment.

9.4 The PECR Soft Opt-In

Where we send SMS messages with marketing content to existing customers, we rely on the soft opt-in exemption under Regulation 22(3) of the Privacy and Electronic Communications Regulations (PECR). This applies where:

• We obtained your contact details in the course of providing a service to you
• The marketing relates to similar products or services to those already provided
• You were given a clear opportunity to opt out when your details were collected, and in every subsequent message

9.5 Automated Processing and Article 22 UK GDPR

Our AI-assisted messaging system does not constitute solely automated decision-making within the meaning of Article 22 of the UK GDPR. No decisions that produce legal or similarly significant effects on you are made by the AI system without human involvement. The system is used to facilitate communication; all regulated advice and any significant decisions require human review and authorisation.

9.6 Vulnerable Customers

We are committed to treating all customers fairly, including those who may be in vulnerable circumstances. Our AI-assisted messaging system is configured to identify potential signals of vulnerability — such as references to financial difficulty, bereavement, or health issues — and to escalate such conversations immediately to a human adviser. If you feel you need additional support at any time, please tell us and we will ensure you are dealt with by a member of our team.

10. Call Recording

We record telephone calls for the following purposes:

• Monitoring and improving customer service
• Training and development of our personnel
• Investigating and resolving complaints
• Meeting our regulatory record-keeping obligations

Call recordings are encrypted and stored securely. They are retained for 12 months unless a longer period is required for a complaint or regulatory matter.

If you object to your call being recorded, please tell us at the start of the call. We will explain the alternative communication channels available to you.

11. Your Rights Under UK Data Protection Law

You have the following rights in relation to your personal data. To exercise any of these rights, please contact us using the details in Section 13. We will respond within one calendar month, subject to satisfactory identification.

Requests may be sent to Christie West at c.west@mortgagedecisions.com or by post to 123 Winchester Road, Chandlers Ford, SO53 2DR.

Please note that exercising some rights may affect our ability to provide our services to you.

12. How We Keep Your Data Secure

We take the security of your personal data seriously. We use appropriate technical and organisational measures to protect your data against unauthorised access, loss, or destruction. These include:

• Encryption of data in transit and at rest
• Access controls limiting data access to relevant personnel only
• Secure cloud infrastructure hosted within the UK (AWS eu-west-2, London region)
• Contractual data security obligations imposed on all data processors
• Regular review of our security practices

No transmission of data over the internet is completely secure. While we take all reasonable steps to protect your data, we cannot guarantee the security of data transmitted to us electronically. You transmit data at your own risk.

13. How to Contact Us

For all data protection queries, subject access requests, or complaints about how we handle your personal data, please contact:

Christie West — Data Protection Contact

Email: c.west@mortgagedecisions.com

Post: 123 Winchester Road, Chandlers Ford, SO53 2DR

Telephone: 03454 500200

We will acknowledge your request within five working days and respond in full within one calendar month, subject to receiving satisfactory identification.

14. Right to Complain to the ICO

If you are not satisfied with our response or believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the UK data protection regulator, the Information Commissioner’s Office (ICO).

Website: www.ico.org.uk

Telephone: 0303 123 1113

Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would, however, appreciate the opportunity to address any concerns before you contact the ICO, so please contact us in the first instance.

15. Website and Cookies

When you visit our website at www.mortgagedecisions.com, we may collect information about your visit automatically, including your IP address, browser type, and pages accessed. This information is used to improve the website experience and is processed in accordance with our Cookie Policy, available at www.mortgagedecisions.com/cookie-policy.

16. Changes to This Notice

We may update this privacy notice from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will post the updated notice on our website with a revised effective date. Where changes are material, we will notify existing customers by email or by a prominent notice on our website.

This notice was last amended on June 2026. Version history is available on request.