Privacy notice

1. Introduction and data controller disclosures

Campden Brook Limited ("we", "us", "our") is committed to protecting and respecting your privacy. This privacy notice explains how we collect, process, store and share your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018) and the Privacy and Electronic Communications Regulations 2003 (PECR).

Dual data controllership

Campden Brook Limited acts as a data controller for the personal information gathered directly from you to deliver mortgage and protection advice, and to refer you to specialist partners where we don't advise ourselves.

Because we operate as an Appointed Representative of The Right Mortgage Limited (our principal network), The Right Mortgage Limited also acts as an independent data controller for regulatory supervision, file auditing, compliance monitoring and anti-money laundering oversight.

• Campden Brook Limited: Linden House, 34 Crowhurst Mead, Godstone, RH9 8BF. Registered in England & Wales, No. 16664135. Email: hello@campdenbrook.co.uk.
• The Right Mortgage Limited (Data Protection Officer): St John's Court, 70 St John's Close, Knowle, Solihull, B93 0NH. Email: dpo@therightmortgage.co.uk.

2. Personal data we collect

To provide regulated mortgage and protection advice, we must collect and process detailed information about your personal and financial circumstances. This includes:

• Identity data: full legal name, title, date of birth, marital status, nationality, National Insurance number, driving licence, passport details and proof of address.
• Contact data: residential address history (usually 3 to 5 years), personal email address and telephone numbers.
• Financial data: bank statements, payslips, accounts or tax calculations (SA302s) for self-employed applicants, details of income, monthly expenditure, existing credit commitments, loan balances and credit records.
• Property data: details of the property being bought or remortgaged, valuation reports, tenure and solicitor details.
• Special category data (health and medical data): when advising on protection products (life cover, critical illness cover, income protection), we collect relevant health information, medical history, lifestyle factors (for example smoking or alcohol consumption) and family medical history. This is processed strictly with your explicit consent.
• Criminal offence data: details of unspent criminal convictions, or bankruptcy and IVA records, where lenders or insurers require them for fraud prevention and underwriting.

3. How we collect your personal data

• Direct interactions: information you give us through our website enquiry form, electronic fact-find portals, telephone conversations, emails and face-to-face meetings.
• Referrals from introducers: where you've been referred to us by a solicitor, conveyancer, estate agent or other professional introducer, we receive your contact and transaction details from them, with your agreement, including through secure onboarding platforms (such as Briidge and Tsuro) and under data sharing agreements.
• Third parties and public sources: credit reference agencies (Equifax, Experian, TransUnion), mortgage lenders, insurance underwriters, estate agents, conveyancers and HM Land Registry.

4. Lawful bases for processing

We process your data under the following lawful bases under UK GDPR Article 6 (and Article 9 for special category data):

• Delivering mortgage and protection advice (identity, contact, financial and property data): contractual necessity (Art 6(1)(b)). Processing is necessary to take steps at your request before entering into a contract, and to fulfil our advice agreement.
• Processing health and insurance data (special category health data): explicit consent (Art 9(2)(a)), collected during the protection fact-find.
• Regulatory oversight and file audits (all categories): legal obligation (Art 6(1)(c)). Compliance with FCA MCOB and ICOBS rules, Senior Management Arrangements, Systems and Controls (SYSC) and the Money Laundering Regulations 2017.
• Soft credit searches and identity verification (identity, contact and credit records): legitimate interests (Art 6(1)(f)). Necessary to verify identity, prevent fraud and confirm affordability.
• Co-ordinating your transaction and referrals (identity, contact and transaction milestones): legitimate interests or consent. Sharing progress with your solicitor or conveyancer so the legal and financial work completes together, and passing your details to a specialist partner when you've asked us to refer you.

5. Soft credit footprints and credit reference agencies

To check your identity and assess mortgage affordability, we, our sourcing platforms (for example Acre and Twenty7tec) and lenders may carry out electronic identity checks and decision-in-principle searches through credit reference agencies such as Equifax, Experian or TransUnion.

• Soft footprint: these initial searches leave a soft footprint on your credit file.
• Impact: a soft footprint is visible only to you and doesn't affect your credit rating, score or ability to get credit. It isn't visible to other lenders or commercial third parties.
• Hard footprint: a hard footprint is only registered on your credit file when a full mortgage application is submitted to a lender with your agreement.

6. Data sharing and recipients

We never sell, rent or trade your personal data to third parties for marketing. We share your personal data only where necessary with:

• The Right Mortgage Limited: our principal firm, for compliance supervision, file sampling and regulatory reporting.
• Mortgage lenders and insurance providers: to submit decisions in principle and applications, and to obtain underwriting decisions.
• Your solicitor or conveyancer, and professional introducers: where they're involved in your transaction, to keep the legal and financial work moving together.
• Specialist partners we refer you to: for example for general insurance, business protection, commercial finance or later life lending, only when you've asked us to make the introduction.
• Technology providers: software platforms that support our work, including Acre, Twenty7tec, 360 Lifecycle, Briidge and Tsuro.
• Credit reference and anti-money laundering agencies: for identity checks and fraud prevention.
• Regulators and law enforcement: the FCA, the Information Commissioner's Office (ICO), HM Revenue & Customs (HMRC) and the National Crime Agency (NCA), where the law requires it.

7. How long we keep your data

In line with FCA record-keeping requirements and our legal obligations:

• Mortgage advice files: kept for at least 6 years from the date of recommendation or completion.
• Lifetime mortgage and equity release files: kept indefinitely, because of the long-term nature of potential advice liabilities.
• Insurance and protection files: kept for the life of the policy plus 6 years after it's cancelled or ends.
• Enquiries and applications that don't go ahead: kept for 2 years after our last contact, then securely deleted.

8. Your rights under UK GDPR

• Right of access: you can ask for a copy of the personal data we hold about you, free of charge (a subject access request).
• Right to rectification: you can ask us to correct inaccurate or incomplete data.
• Right to erasure: you can ask us to delete your data where we no longer need it, subject to our FCA record-keeping obligations.
• Right to restrict processing: you can ask us to pause processing your data in certain circumstances.
• Right to object: you can object to processing based on legitimate interests, or to direct marketing.
• Right to data portability: you can ask for a structured, machine-readable copy of your personal data.

To exercise any of these rights, please write to: Data Protection, Campden Brook Limited, Linden House, 34 Crowhurst Mead, Godstone, RH9 8BF, or email hello@campdenbrook.co.uk (or dpo@therightmortgage.co.uk for matters relating to our principal firm).

We'll respond to all valid requests within one calendar month of receiving them.

9. How to complain to the Information Commissioner's Office

If you have concerns about how we've collected, handled or processed your personal data, please contact us first so we can try to put it right.

You also have the right to complain at any time to the UK data protection regulator:

• Information Commissioner's Office (ICO)
• Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
• Helpline: 0303 123 1113
• Website: ico.org.uk/make-a-complaint