Campden Brook Limited — UK GDPR Privacy Notice

 

Company Name: Campden Brook Limited

Registered Office Address: Linden House, 34 Crowhurst Mead, Godstone, RH9 8BF

Company Registration Number: 16664135

FCA Firm Reference Number (FRN): 1058815

Principal Firm: The Right Mortgage Limited (FCA FRN: 649443)

Contact Email: hello@campdenbrook.co.uk

DPO Email: dpo@therightmortgage.co.uk

Effective Date: August 2026

Version: 3.0 (Aligned with UK GDPR, DPA 2018 & Network Standards)

​

​

1. Introduction & Data Controller Disclosures

Campden Brook Limited ("we", "us", "our") is committed to protecting and respecting your privacy. This Privacy Notice explains how we collect, process, store, and share your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), and the Privacy and Electronic Communications Regulations 2003 (PECR).

​

Dual Data Controllership

Campden Brook Limited acts as a Data Controller in respect of the personal information gathered directly from you to deliver mortgage, protection, and general financial advisory services.

​

Because we operate as an Appointed Representative of The Right Mortgage Limited (our Principal Network), The Right Mortgage Limited also acts as an independent Data Controller for regulatory supervision, file auditing, compliance monitoring, and anti-money laundering oversight.

• Campden Brook Limited: Haydon House, Church Street, Chipping Campden, GL55 6JG. Reg: 16664135. Email: hello@campdenbrook.co.uk.

• The Right Mortgage Limited (Data Protection Officer): St John’s Court, 70 St John’s Close, Knowles, Solihull, B93 0NH. Email: dpo@therightmortgage.co.uk.

 

​

2. Personal Data We Collect

To provide regulated mortgage and protection advice, we must collect and process detailed information regarding your personal and financial circumstances. This includes:

• Identity Data: Full legal names, title, date of birth, marital status, nationality, national insurance number, driving licence, passport details, and proof of address.

• Contact Data: Residential address history (minimum 3–5 years), personal email address, telephone numbers.

• Financial Data: Bank statements, payslips, accounts/tax calculations (SA302s) for self-employed applicants, details of income, monthly expenditure, existing credit commitments, loan balances, and credit score records.

• Property Data: Details of the property being purchased or re-mortgaged, valuation reports, tenure, and solicitor details.

• Special Category Data (Health & Medical Data): When advising on pure protection products (Life Assurance, Critical Illness, Income Protection), we collect relevant health information, medical history, lifestyle factors (e.g. smoking/alcohol consumption), and family medical history. This is processed strictly with your explicit consent.

• Criminal Offence Data: Details regarding unspent criminal convictions or bankruptcy/IVA records where required by lenders/insurers for fraud prevention and underwriting.

​

​

3. How We Collect Your Personal Data

We collect personal data through multiple channels:

1. Direct Interactions: Information provided by you on our website contact forms, electronic fact-find portals, telephone conversations, email exchanges, and face-to-face meetings.

2. Squid Group Ecosystem Partner Referrals: Where you have been referred to us by or are utilising the services of our sister professional practices within the Squid Group—specifically Kingsley Bond Solicitors or Montrose Brown—we receive your contact and transaction details via secure integrated platforms (such as Briidge and Tsuro) under formal Data Sharing Agreements.

3. Third Parties & Public Sources: Credit Reference Agencies (Equifax, Experian, TransUnion), mortgage lenders, insurance underwriters, estate agents, conveyancers, and HM Land Registry.

 

4. Lawful Bases for Processing

We process your data under the following lawful bases under UK GDPR Article 6 (and Article 9 for Special Category Data):

​

Delivering Mortgage & Protection Advice

Identity, Contact, Financial, Property

Contractual Necessity (Art 6(1)(b)) — Processing is necessary to take steps at your request prior to entering into a contract and to fulfil our advisory agreement.

 

Processing Health & Insurance Data

Special Category Health Data

Explicit Consent (Art 9(2)(a)) — Collected with your explicit consent during protection fact-finding.

 

Regulatory Oversight & File Audits

All Categories

Legal Obligation (Art 6(1)(c)) — Compliance with FCA MCOB/ICOBS rules, Senior Management Systems and Controls (SYSC), and Money Laundering Regulations 2017.

​

Soft Credit Searches & Identity Verification

Identity, Contact, Credit Records

Legitimate Interests (Art 6(1)(f)) — Necessary to verify identity, combat fraud, and confirm affordability.

 

Ecosystem Service Co-ordination

Identity, Contact, Transaction Milestones

Legitimate Interests / Consent — Sharing milestone data with Kingsley Bond Solicitors or Montrose Brown to ensure synchronised legal and financial completion

​

​​

5. Soft Credit Footprints & Credit Reference Agencies

To validate your identity and evaluate mortgage affordability, we or our partner sourcing platforms (e.g. Acre, Twenty7tec) and lenders may carry out electronic identity checks and decision-in-principle searches through Credit Reference Agencies (CRAs) such as Equifax, Experian, or TransUnion.

• Soft Footprint: These initial searches leave a "soft credit footprint" on your credit file.

• Impact: A soft footprint is visible only to you and does not affect your credit rating, score, or ability to obtain credit. It is not visible to other lenders or commercial third parties.

• Hard Footprint: A "hard footprint" will only be registered on your credit file when a formal, full mortgage application is submitted to a lender by your agreement.

 

 

6. Data Sharing & Third-Party Recipient Categories

We strictly do not sell, rent, or trade your personal data to third parties for commercial marketing. We share your personal data only where necessary with the following entities:

1. The Right Mortgage Limited: Our Principal firm, for compliance supervision, file sampling, and regulatory reporting.

2. Mortgage Lenders & Insurance Underwriters: To submit Decisions in Principle, formal applications, and secure underwriting decisions.

3. Squid Group Entities (Kingsley Bond Solicitors & Montrose Brown): Where legal or conveyancing services are integrated into your transaction, data is shared via secure APIs to ensure seamless legal progression.

4. Third-Party Technology Providers: Software platforms supporting our practice, including Acre Software, Twenty7tec, 360 Lifecycle, and Tsuro.

5. Credit Reference & Anti-Money Laundering Agencies: For identity checks and fraud prevention.

6. Regulatory Authorities & Law Enforcement: The FCA, Information Commissioner’s Office (ICO), HM Revenue & Customs (HMRC), and National Crime Agency (NCA) where mandated by law.

 

 

7. Data Retention Policy

In accordance with FCA record-keeping requirements (MCOB Schedule 1) and legal obligations:

• Mortgage Advice Files: Retained for a minimum of 6 years from the date of recommendation or completion.

• Indefinite Retention: Files involving lifetime mortgages, equity release, or pension-related transfers are retained indefinitely due to the long-term nature of potential advice liabilities.

• Insurance / Protection Files: Retained for the duration of the policy plus 6 years post-cancellation or expiration.

• Uncompleted Applications / Enquiries: Retained for 2 years following last contact before secure deletion.

 

 

8. Your Legal Rights under UK GDPR

Under UK GDPR, you hold specific rights regarding your personal data:

• Right of Access (Subject Access Request - SAR): You have the right to request a copy of the personal data we hold about you free of charge.

• Right to Rectification: You can request that we correct inaccurate or incomplete data.

• Right to Erasure ("Right to be Forgotten"): You can request deletion of your data where processing is no longer required, subject to our statutory FCA record-keeping obligations.

• Right to Restrict Processing: You may request that we suspend processing your data in certain circumstances.

• Right to Object: You have the right to object to processing based on legitimate interests or direct marketing.

• Right to Data Portability: You may request a structured, machine-readable copy of your personal data.

 

To exercise any of these rights, please submit your request in writing to:

Data Protection Officer, Campden Brook Limited Address: Haydon House, Church Street, Chipping Campden, GL55 6JG

Email: hello@campdenbrook.co.uk (or dpo@therightmortgage.co.uk for Principal matters).

We will respond to all valid requests within one calendar month of receipt.

 

 

9. How to Complain to the Information Commissioner's Office (ICO)

If you have concerns about how we have collected, handled, or processed your personal data, we invite you to contact our DPO first so we can resolve the issue.

However, you retain the absolute right to lodge a formal complaint at any time with the UK data protection regulator:

• Organisation: Information Commissioner’s Office (ICO)

• Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

• Helpline Telephone: 0303 123 1113

• Website: https://ico.org.uk/make-a-complaint/