On this page
- Who we are
- Who this notice is for
- What information we collect
- Special category information
- Why we use it, and our lawful basis
- Marketing
- Our website, cookies and the tools we use
- Who we share information with
- Sending information outside the UK
- How long we keep it
- How we protect it
- Automated decisions
- Your rights
- Contacting us
- Complaining to the ICO
- Changes to this notice
1. Who we are
Make Mortgages Easy Ltd ("Make Mortgages Easy", "we", "us", "our") is the data controller for the personal information described in this notice.
- Registered in England & Wales, company number 14018724
- Registered office: 4 Kentmere Drive, Wirral, CH61 5XL
- Trading address: 22 Thingwall Road, Irby, Wirral, CH61 3UE
- Registered with the Information Commissioner's Office, registration number ZB324102
- An Appointed Representative of Stonebridge Mortgage Solutions Limited, which is authorised and regulated by the Financial Conduct Authority. FCA number 974168
We comply with the UK General Data Protection Regulation and the Data Protection Act 2018. You can check our ICO registration on the ICO register of data controllers.
An important point about our regulatory relationship. Because we are an Appointed Representative, Stonebridge Mortgage Solutions Limited is responsible for the advice we give and holds its own records of your case. Stonebridge is a separate data controller in its own right. Their privacy notice is available on their website and sits alongside this one.
2. Who this notice is for
This notice covers personal information we hold about:
- People who visit our website
- People who contact us with an enquiry but do not go on to become clients
- Our clients, and anyone named on a joint application
- People connected to a client's case, such as a dependant named for protection purposes
- Our suppliers, contractors and professional contacts
If you are applying to work with us, ask us for our separate job applicant privacy notice.
Joint applications. Where two or more people apply together, we cannot separate the information between you. Everything relevant to the application is visible to everyone named on it, and to the lender.
3. What information we collect
If you fill in a form or contact us
Our website enquiry form asks for your name, email address, mobile number, postcode, what you need help with, and the value of the property. You are not obliged to give us any of it, but we cannot come back to you without it.
If you become a client
To advise on a mortgage or a protection policy we need considerably more, typically including:
- Full name, date of birth, nationality, marital status and residential history
- Contact details
- Identity documents, such as a passport or driving licence
- Income and employment details, including payslips, accounts, SA302s and tax year overviews
- Bank statements and details of your regular spending
- Existing credit commitments, and information from your credit file
- Details of dependants and other household members
- Details of the property involved
- Records of our conversations, our advice, and the documents we produce for you
If you visit our website
Our website collects limited technical information, including your IP address and how you move around the site. This is covered in section 7 and in our cookie policy.
4. Special category information
Some information is treated as more sensitive under data protection law. We may process:
- Health information, where we advise on life cover, critical illness cover or income protection. Insurers need to know about your medical history to decide whether to offer cover and on what terms.
- Information about vulnerability, where you tell us about circumstances that mean you may need additional support. The FCA expects us to record and act on this so we can treat you fairly.
- Information about criminal convictions, where this is relevant to identity, fraud prevention or a lender's requirements.
We keep health information out of our online booking tool. Our booking form never asks anything medical, and our booking provider's terms do not permit sensitive information to be submitted through it. If you book an appointment online, please don't add medical details to the notes. Anything of that kind is discussed with us directly and recorded on your file instead.
Where we process health information for protection advice, we rely on your explicit consent, which you can withdraw at any time — though we may then be unable to continue advising you. Where we record vulnerability, we do so to comply with FCA requirements on the fair treatment of vulnerable customers and in your substantial public interest.
We do not use biometrics or facial recognition. We verify identity by looking at your documents, not by scanning your face against them.
5. Why we use it, and our lawful basis
| What we do | Our lawful basis |
|---|---|
| Responding to your enquiry and working out whether we can help | Our legitimate interests in responding to a request for our services, and steps taken at your request before entering a contract |
| Providing mortgage and protection advice, submitting applications and managing your case through to completion | Necessary to perform our contract with you |
| Assessing affordability and suitability, including reviewing your credit file | Necessary to perform our contract with you, and to comply with our regulatory obligations |
| Verifying your identity, preventing and detecting financial crime, and meeting anti-money-laundering obligations | Necessary to comply with our legal obligations |
| Advising on protection and sharing health information with insurers | Your explicit consent |
| Recording and acting on vulnerability | Compliance with our regulatory obligations, and substantial public interest |
| Keeping records of the advice we give, as our regulator requires | Necessary to comply with our legal obligations |
| Reporting to Stonebridge and to the FCA | Necessary to comply with our legal obligations |
| Asking for your feedback and inviting a review | Our legitimate interests in improving our service. You can decline |
| Sending you marketing, where you have asked us to | Your consent |
| Contacting existing clients about a mortgage deal that is coming to an end | Our legitimate interests in providing continuity of service to our own clients |
| Running and improving our business, including anonymised reporting | Our legitimate interests in managing and developing our business |
| Dealing with complaints, disputes and legal claims | Our legitimate interests in defending our position, and compliance with legal obligations |
6. Marketing
We will only send you marketing if you have asked us to. Making an enquiry does not sign you up to anything.
When you complete our enquiry form you are agreeing that we may contact you about that enquiry. That is not the same as consenting to marketing, and we will not treat it as such.
If you do opt in, every email we send contains an unsubscribe link, and you can also ask us to stop at any time by emailing tom@makemortgageseasy.co.uk. We will never sell, rent or share your details with third parties for their own marketing.
Separately from marketing, if you are an existing client we may contact you when a fixed rate is coming to an end. We regard that as part of the service you came to us for rather than promotion, and you can ask us not to.
7. Our website, cookies and the tools we use
Our website uses a small number of third-party services. Each one may collect information about you, and each acts either as our processor or as a controller in its own right.
| Service | Who runs it, and where | What it involves |
|---|---|---|
| Formspree Delivers our enquiry form to us by email | Formspree, Inc. Hosted on Amazon Web Services in the United States | Receives everything you type into the form, emails it to us, and keeps a copy in our account. Databases are encrypted at rest and traffic is encrypted in transit. Independently audited to SOC 2 Type II |
| Calendly Lets you book an appointment online | Calendly LLC, Georgia, United States | Collects your name, email address and anything you add when booking, plus the appointment details |
| Trustindex Displays our Google reviews | Trustindex Ltd, Hungary (European Union) | Loads review content from a third party and may set cookies. It does not collect anything about you beyond that |
| Google Analytics Tells us how the site is used | Google Ireland Limited, with processing in the United States and elsewhere | Sets cookies and collects information about the pages you view, how you arrived, your approximate location and your device. Only loads if you accept analytics cookies. We use it to understand which pages are useful, not to identify you |
| Our website host | United Kingdom or European Union | Server logs, including IP addresses, kept briefly for security and performance |
One point about the booking tool. Where our booking calendar is embedded on this website, Calendly and we are separate and independent controllers of the information its cookies collect. That means Calendly is responsible for that data in its own right, under its own privacy notice, as well as us being responsible for ours.
Non-essential cookies, including analytics, do not load until you accept them. You can change your choice at any time. Full detail is in our cookie policy.
8. Who we share information with
If you message us on WhatsApp. WhatsApp is provided by Meta, and any message you send us passes through their service under their own terms and privacy notice. Messages are encrypted in transit, but please don't send identity documents, bank statements or medical details that way. We'll ask you to use the secure client portal for anything of that kind, and we copy anything relevant to your advice onto your file.
We share your information only where we need to. We do not sell it. Depending on your case, that may include:
- Stonebridge Mortgage Solutions Limited, our principal firm, which is responsible for the advice we give and reviews our case files
- Lenders and insurers we approach on your behalf
- Credit reference agencies, where a credit search is needed
- Solicitors, conveyancers, estate agents and accountants connected to your transaction, where you have asked us to liaise with them
- Our software and service providers, including our client management system, and the website tools listed in section 7
- Our professional advisers, such as auditors and legal advisers
- The FCA and other regulators, and the Financial Ombudsman Service if a complaint is referred
- Law enforcement, HMRC, courts and tribunals, where we are legally required to
Where a third party processes information on our behalf, they act on our written instructions, are under a duty of confidentiality, and must keep it secure.
Two things we do not do. We do not pass your information to debt collection or tracing agencies, and we are not part of a group of companies, so there is no group to share it within.
9. Sending information outside the UK
Some of the website tools we use are based in the United States, which means some of your information is transferred outside the UK. Where that happens we make sure it is protected to a standard equivalent to UK law.
| Provider | Where | Safeguard relied on |
|---|---|---|
| Formspree | United States | Standard contractual clauses, together with the UK International Data Transfer Addendum |
| Calendly | United States | Calendly is self-certified under the UK Extension to the EU–US Data Privacy Framework. If that framework ceases to be valid, transfers fall back to standard contractual clauses together with the UK International Data Transfer Addendum |
| Google Analytics | United States and elsewhere | Google is self-certified under the UK Extension to the EU–US Data Privacy Framework, and relies on standard contractual clauses with the UK Addendum where the framework does not apply |
| Trustindex | Hungary, European Union | No transfer safeguard needed for the EU itself, which the UK recognises as adequate. Where Trustindex uses its own providers outside the EU it relies on adequacy decisions, standard contractual clauses or the UK Addendum |
Where we send information to lenders, insurers, Stonebridge or our other professional contacts, that stays within the UK.
10. How long we keep it
| Information | How long |
|---|---|
| Enquiries that do not become cases | 12 months from your last contact with us, then securely deleted |
| Client files, advice records and suitability reports | Six years from the end of our relationship with you, to meet our regulatory record-keeping obligations |
| Records relating to protection policies | For as long as the policy remains in force, and for six years after it ends |
| Anti-money-laundering and identity records | Five years from the end of the business relationship |
| Complaints | For as long as the related mortgage or policy remains in force, and for a minimum of six years after it ends |
| Marketing preferences | Until you ask us to stop, and then a record of your objection so we honour it |
11. How we protect it
We take the security of your information seriously. We use technical and organisational measures to protect it against loss, misuse and unauthorised access, and we restrict access to those who need it to do their job. Where we use third parties, they are contractually obliged to do the same.
We encourage clients to use the secure client portal for sending documents rather than email, because email is not a secure way to send identity documents or bank statements.
12. Automated decisions
We do not make decisions about you based solely on automated processing.
Lenders and insurers, however, often do. When you apply, a lender may use automated credit scoring to decide whether to lend and on what terms. That decision is theirs, not ours, and their own privacy notice will explain it. If you are declined on that basis you have the right to ask the lender for an explanation and to ask for the decision to be reviewed by a person.
13. Your rights
You have the right to:
- Be informed about how we use your information, which is what this notice is for
- Access a copy of the information we hold about you
- Rectification of anything inaccurate or incomplete
- Erasure of your information, in certain circumstances
- Restrict how we use it, in certain circumstances
- Portability, meaning you can ask for it in a transferable format
- Object to processing based on our legitimate interests, and to direct marketing at any time
- Withdraw consent where we rely on it, at any time
Some of these rights are qualified. We are required by our regulator to keep records of the advice we give, so we may not be able to erase a client file on request even if you ask us to. If we cannot do what you have asked, we will explain why.
There is no charge for making a request, and we will respond within one month. If a request is clearly unfounded or excessive we may charge a reasonable fee or decline it, and we will tell you why.
14. Contacting us
For anything about your information, or to exercise any of the rights above, contact:
- Thomas Williams, Data Protection Manager
- Make Mortgages Easy Ltd, 22 Thingwall Road, Irby, Wirral, CH61 3UE
- tom@makemortgageseasy.co.uk
- WhatsApp us
- 0151 388 0015
15. Complaining to the ICO
If you are unhappy with how we have handled your information, please tell us first so we have the chance to put it right.
You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection, at ico.org.uk/make-a-complaint or on 0303 123 1113. You can go to the ICO without coming to us first.
If your complaint is about the mortgage or protection advice itself rather than your information, that goes through a different route. See our complaints page.
16. Changes to this notice
We update this notice from time to time, when the law changes or when we change how we work. The current version is always at makemortgageseasy.co.uk/privacy-policy.
Last updated: September 2026