Privacy Notice

What data we collect

When you use our contact form, we collect your name, email address, phone number, and details about your mortgage enquiry. This information is necessary to provide you with mortgage advice.

When we begin advising you, we will collect further information including details to verify your identity, family and lifestyle information, financial information, and — where relevant to the advice — health and other special category information.

We collect technical data automatically when you visit this website, including your IP address, browser type, and pages visited. This is gathered through cookies and similar technologies (see our Cookie Policy for details).

Our lawful basis for processing your data

We process your personal data on two main lawful bases:

• Performance of a contract. When we provide advice or arrange a mortgage or protection product, we process your data because it is necessary to deliver the service you have asked for.
• Legitimate interest. When we contact you about services you have previously enquired about, or carry out limited marketing activity, we rely on legitimate interest. You have the right to object to this processing — see "Your rights" below.

Where we need to process special category data (such as health information for a protection product application), we will ask for your explicit consent. You can withdraw that consent at any time.

How we use your data

We use your personal data to:

• respond to your enquiry
• provide mortgage and protection advice
• submit applications to lenders and insurers on your behalf
• communicate with you about your mortgage or protection products
• verify your identity and prevent fraud, money laundering, and other malpractice
• meet our legal and regulatory obligations
• improve our website (using anonymised analytics data — see our Cookie Policy)

We will not use your data for marketing purposes unless you have given us explicit consent. You can withdraw that consent at any time using the contact details below.

How we store your data

Form submissions and client data are stored securely using Supabase, a cloud database service with servers located in the EU (London region). Data is encrypted in transit and at rest.

We retain different categories of data for different periods, in line with our regulatory obligations:

• Enquiry data (where no advice was given): up to 3 years after your last interaction with us.
• Advice records: at least 6 years from the end of our relationship, in line with FCA record-keeping rules.
• Anti-money-laundering records: 5 years after the end of our relationship, in line with the Money Laundering Regulations 2017.
• Complaint records: at least 3 years from the date of complaint, in line with FCA DISP rules.

Our full Data Retention and Disposal Schedule is available on request. You can request earlier deletion at any time, subject to our regulatory obligations.

Who we share your data with

To provide our services, we share your data with:

• Lenders and insurers when submitting applications on your behalf — we will always discuss this with you before submitting.
• Lyncombe Consultants Ltd as our principal firm, and other firms in the Adviser Services Holdings Limited (ASHL) group of companies.
• Identity verification and fraud prevention services to meet anti-money-laundering and other regulatory obligations.
• The Financial Conduct Authority and other regulators where required by law or regulation.
• Our website infrastructure providers: Supabase (data storage, EU/London), Resend (email delivery), Google Analytics 4 (website analytics, anonymised), and Vercel (website hosting).

We do not sell your personal data to third parties.

Where any of these third parties are based outside the UK or European Economic Area, we ensure appropriate safeguards are in place to protect your data, in line with UK GDPR.

Your rights under UK GDPR

You have the following rights in relation to your personal data:

• The right to be informed about how we process your data — this notice fulfils that right.
• The right of access to the personal data we hold about you.
• The right to rectification of inaccurate or incomplete data.
• The right to erasure of your data, subject to our regulatory obligations.
• The right to restrict processing of your data in certain circumstances.
• The right to data portability — to obtain and reuse your data.
• The right to object to processing based on legitimate interest, including direct marketing.
• The right not to be subject to automated decision-making, including profiling.

To exercise any of these rights, contact us at enquiries@hansonmb.co.uk. We will respond within 30 days.

How to complain

If you are concerned about how we have handled your personal data, please contact us first using the details above so we can try to resolve the issue.

You also have the right to complain to the Information Commissioner's Office (ICO):

Changes to this notice

We may update this privacy notice from time to time. Any changes will be posted on this page with an updated date. We encourage you to review this notice periodically. Previous versions are available on request.