Privacy Notice Ashleigh Mortgages

Ashleigh Mortgages · Last updated: 02/10/2026

This notice explains what personal information we collect when you ask us for mortgage or insurance advice, why we need it, who we share it with, and the choices and rights you have. We've tried to keep it clear and straightforward. If anything isn't clear, please get in touch.

1. Who we are

Ashleigh Mortgages is a trading name of Keith Hunter, a sole trader. Keith is the "controller" of your personal information, which means he is responsible for deciding how it's used and for keeping it safe. When this notice says "we", "us" or "our", it means Keith Hunter trading as Ashleigh Mortgages.

Main business address

Portland House, Belmont Business Park, Durham, DH1 1TW

London office

124 City Road, London, EC1V 2NX

Telephone

0333 7720 173

info@ashleighmortgages.co.uk

FCA registration

Authorised and regulated by the Financial Conduct Authority, Financial Services Register number 628591

ICO registration

ZA040881

Data protection contact: we are not required to appoint a Data Protection Officer. If you have any questions about this notice or how we handle your information, please email info@ashleighmortgages.co.uk, call 0333 7720 173, or write to us at the address above.

2. The personal information we collect

To give you suitable advice and arrange a mortgage or insurance, lenders and insurers need a detailed picture of you and your finances. Depending on what you ask us to help with, we may collect:

Identity details: name, previous names, date of birth, age, nationality, marital status, and copies of your passport and proof of residency.
Contact details: current and previous addresses, phone numbers and email address.
Household details: details of dependants (such as children's ages) and household spending, where lenders need this for affordability.
Employment and income: employer, job title, salary, pension, payslips, P60s, bank statements, and for self-employed clients, accounts, tax calculations (SA302s) and tax year overviews.
Financial position: existing mortgages, loans, credit cards and other commitments, savings, deposit source, gifted deposits, and details of properties you own or let, including buy-to-let and commercial property.
Credit history: the credit report we ask you to provide, including any missed payments, defaults, county court judgments (CCJs), IVAs, bankruptcy or previously declined applications.
Property details: the property you are buying or remortgaging, its value, and details of your solicitor and estate agent.
Health information: where it's relevant to your mortgage application or any insurance you ask us about (see section 5).
Business information: for commercial or limited company buy-to-let mortgages, details of the company and its directors and shareholders.
Your circumstances and needs: your plans and anything that helps us support you, including circumstances that may make you more vulnerable (see section 5).
Payment information: records of fees you pay us by bank transfer. We never take card payments over the phone.
Communications: emails, letters, WhatsApp messages, notes of meetings (in person or by FaceTime video call), and recordings of some phone calls (see section 9).
Website information: information collected when you use our website or contact form or book an appointment through Calendly (see section 14).

Information about other people. If you give us information about someone else, such as a joint applicant, a family member who is gifting a deposit, or a guarantor, please make sure they're happy for you to do this and show them this notice.

3. Where we get your information from

Most of the information we hold comes directly from you, through our introductory pack, fact-find, phone calls, emails and the documents you send us. We may also receive information from:

a joint applicant, or a family member providing a gifted deposit;
your solicitor, estate agent, accountant or employer, where you've asked us to deal with them;
lenders and insurers, including updates on your application and offer;
the credit reference agency report you obtain and share with us;
an introducer who has referred you to us. If you came to us this way, the introducer would have completed a fact-find with you and passed it to us with your agreement;
someone who has recommended us to you, if they pass on your details with your agreement;
publicly available sources, such as the electoral roll, Land Registry and Companies House (for example, for limited company buy-to-let).

4. How we use your information and our lawful bases

Data protection law says we must have a valid reason, called a "lawful basis", every time we use your personal information. Here's what we do and why.

What we use your information for

Understanding your needs, searching the market and giving you mortgage advice, including residential, buy-to-let and commercial mortgages

Our lawful basis:
Contract: you've asked us to act for you, and we need the information to do so

Preparing and submitting applications to lenders, and managing them through to completion

Our lawful basis: Contract

Liaising with your solicitor, estate agent, accountant and other parties at your request

Our lawful basis: Contract

Meeting with you in person or by FaceTime, and keeping in touch by phone, email and WhatsApp during your application

Our lawful basis: Contract

Receiving and recording payment of our fees

Our lawful basis: Contract, and legal obligation for our accounting and tax records

Checking your identity and carrying out anti-money laundering checks

Our lawful basis: Legal obligation under the Money Laundering Regulations 2017

Keeping records of the advice we give, as required by the FCA

Our lawful basis: Legal obligation

Handling complaints, including any referral to the Financial Ombudsman Service

Our lawful basis: Legal obligation, and legitimate interests in resolving complaints fairly

Recording some phone calls for quality, training and to keep an accurate record

Our lawful basis: Legitimate interests (see section 9)

Keeping in touch for the life of your mortgage, for example when your deal is coming to an end so you can review your options

Our lawful basis: Legitimate interests in looking after existing clients (see section 8)

Responding to people introduced or referred to us

Our lawful basis: Legitimate interests

Making sure a qualified adviser can continue to look after clients if Keith is unable to work

Our lawful basis: Legitimate interests

Defending or bringing legal claims, and dealing with our professional indemnity insurers

Our lawful basis: Legitimate interests

Running our business, including IT and security

Our lawful basis: Legitimate interests

Operating our website, contact form and appointment booking

Our lawful basis: Legitimate interests, and consent for non-essential cookies

Where we rely on legitimate interests, we have balanced our interests against yours and are satisfied your rights are not overridden. You can ask us for more detail, and you have the right to object (see section 13).

If you don't give us information we need for your application or to meet our legal obligations, we may not be able to help you.

5. More sensitive information

Some information needs extra protection under data protection law. We only collect it where it's genuinely needed.

Health and lifestyle information. If you ask us to arrange life cover, critical illness cover, income protection or similar insurance, the insurer will need details of your health, medical history and lifestyle to give you a quote and provide cover. We rely on the insurance condition in the Data Protection Act 2018 (Schedule 1, paragraph 20), or your explicit consent. Occasionally a lender may also need health information, for example where it affects your income. We'll only record what's relevant.

Please note: we can provide insurance quotes and arrange cover, but we don't give advice on insurance. If you'd like advice about which cover is right for you, we'll suggest you speak to a financial adviser.

Circumstances that may make you more vulnerable. As an FCA-regulated firm, we must take extra care of clients in vulnerable circumstances, such as illness, bereavement or financial difficulty. If you tell us about something like this, we'll record only what we need to support you properly, and we'll talk to you about it first. We rely on your explicit consent, or the condition for safeguarding the economic well-being of individuals at risk (Data Protection Act 2018, Schedule 1, paragraph 19).

Criminal convictions. Lenders and insurers sometimes ask about unspent criminal convictions. We only record this where it's needed for your application, relying on the conditions in Schedule 1 of the Data Protection Act 2018 (including the insurance and regulatory conditions).

Anti-money laundering. Identity and source-of-funds checks may occasionally reveal information about suspected financial crime. We handle this under our legal obligations to prevent and detect crime.

6. Identity, anti-money laundering and credit checks

We're required by law to verify your identity before we can act for you. We'll ask you for your passport and proof of residency, which we check and keep on your file.

We don't carry out credit searches ourselves. Instead, we ask you to get a copy of your own credit report and share it with us, so we can recommend lenders likely to accept your application. When you apply, the lender will carry out its own credit and fraud checks, and will explain how it does this in its own privacy notice.

If we have reason to suspect money laundering or fraud, we may be required to report it to the National Crime Agency. The law may prevent us from telling you we have done so.

7. Who we share your information with

We never sell your personal information. We only share it where we need to, to act for you, meet our legal obligations, or run our business.

To arrange your mortgage or insurance:

mortgage lenders, including buy-to-let and commercial lenders;
insurers and protection providers, where you ask us to arrange a quote or cover;
solicitors from our panel, where you ask us to arrange conveyancing or legal work for your purchase or mortgage, and your own solicitor or estate agent where you ask us to deal with them;
your accountant, where you ask us to contact them;
second charge and unsecured loan providers, where we've told you one may be more suitable and you agree to be referred;
the introducer who referred you to us, if applicable. We only share what's needed to pay their introduction fee, such as confirmation that your mortgage has completed.

Service providers who support our business. These act on our instructions and must keep your information secure. They include:

Trigold, our mortgage sourcing system, which holds the details needed to search for suitable mortgages;
Microsoft 365, for email (Outlook), document storage (OneDrive) and our client records;
WhatsApp (Meta), where you choose to message us that way;
TAMAR, our call recording provider, and ID Mobile, our mobile network;
Wix.com, our website host, Usercentrics, which manages our cookie banner, and Calendly, which we use for booking appointments;
our accountant.

Regulators and authorities. We may share information with the Financial Conduct Authority, the Financial Ombudsman Service, HMRC, the National Crime Agency, the police, the courts, or the Information Commissioner's Office where we're legally required to or where it's needed to deal with a complaint or claim.

Other situations. We may share information with our professional indemnity insurers and legal advisers. If Keith is unable to work, a named, FCA-qualified mortgage adviser will take over client files so your mortgage can continue to be looked after. If the business is ever sold or transferred, client records may pass to the new owner, who will be bound by this notice.

8. Keeping in touch and marketing

We'll stay in touch during your application and after completion to make sure you're happy with our service. That's part of looking after you as a client, not marketing.

We don't send marketing emails or newsletters, and we don't use your details for advertising. Our new clients come through referrals and our website.

We keep your contact details for the life of your mortgage, so we can get in touch when your deal is coming to an end, or when you might benefit from reviewing it. If you'd rather we didn't, just let us know by emailing info@ashleighmortgages.co.uk or calling 0333 7720 173, and we'll stop.

9. Call recording

Some calls to and from Ashleigh Mortgages are recorded using TAMAR, our call recording service. We do this to keep an accurate record of what was discussed, to help with training and improving our service, and to help resolve any complaint or dispute. Our lawful basis is legitimate interests. We don't record FaceTime video meetings.

Recordings are kept securely for around 30 days and then deleted, unless we need them for a complaint or claim.

10. International transfers

We aim to keep your information in the UK. Some of our service providers may store or access information outside the UK. These include Microsoft (email and cloud storage), Meta (WhatsApp), Wix (our website), Usercentrics (our cookie banner) and Calendly (appointment booking).

Where this happens, we make sure your information is protected. This is either because the UK Government has confirmed the country has adequate data protection laws ("adequacy regulations"), or because we use approved safeguards such as the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can contact us for more information.

11. How long we keep your information

We only keep your information for as long as we need it, or as long as the law or our regulator requires. Where you send us original paper documents, we'll return them to you by post.

Type of information

Client files and advice records (fact-find, suitability letters, illustrations, applications)
How long we keep it

For the life of your mortgage, and then [6 years] after our relationship ends
Why

FCA record-keeping requirements, and so we can respond to complaints to the Financial Ombudsman Service or legal claims

Contact details
How long we keep it

For the life of your mortgage
Why

So we can let you know when your deal is due for review

Identity and anti-money laundering records

How long we keep it
5 years after our relationship ends

Why
Money Laundering Regulations 2017

Fee and accounting records

How long we keep it
6 years from the end of the tax year they relate to

Why
HMRC requirements

Enquiries that don't go ahead

How long we keep it
[12 months from last contact]
Why
In case you come back to us

Call recordings

How long we keep it
Around 30 days
Why

Quality, training and complaint handling

WhatsApp messages

Stored on our mobile phone [for how long]

Why
To keep a record of our conversations with you

When information is no longer needed, we securely delete or destroy it.

12. Keeping your information safe

We take the security of your information seriously. Our client records and documents are stored securely in Microsoft 365 and are password protected. Access is limited to Keith and our administrative staff, who are bound by confidentiality. WhatsApp messages are end-to-end encrypted. We ask our service providers to meet appropriate security standards, and we review our security measures regularly.

If a data breach happens that is likely to put you at risk, we'll tell you and, where required, report it to the Information Commissioner's Office within 72 hours.

13. Your rights

You have rights over your personal information. You can ask us to:

give you a copy of the information we hold about you (a "subject access request");
correct information that is wrong or incomplete;
delete your information, where we no longer have a reason to keep it;
restrict how we use it, for example while we check whether it's accurate;
stop using it where we rely on legitimate interests, unless we have strong reasons to continue;
stop marketing at any time;
transfer information you've given us to another organisation, where we rely on consent or contract and process it electronically;
withdraw your consent where we rely on it.

Some rights have limits. For example, we can't delete records we're legally required to keep. If that applies, we'll explain why.

To use any of these rights, contact us using the details in section 1. There's usually no charge. We'll respond within one month, and if your request is complex, we may need up to two further months; we'll let you know if so. We may ask you to confirm your identity first.

14. Automated decisions, our website and cookies

Automated decisions. We don't make decisions about you using only automated means. Our advice is always given by a qualified adviser. Lenders and insurers may use automated scoring when deciding on your application; their own privacy notices explain this and your rights.

Our website. Our website is hosted by Wix.com. If you use our contact form, book an appointment through Calendly, or email us, we'll use your details to respond to your enquiry.

Cookies. Our website uses a small number of cookies that are essential for it to work. We don't currently use analytics or advertising cookies. If we ever do, we'll only use them with your consent. You can manage your choices at any time through the cookie banner on our website. For more details, please see our Cookie Policy.

15. Complaints and changes to this notice

Complaints. If you're unhappy with how we've handled your personal information, please tell us first so we can put it right. We'll acknowledge your complaint within 30 days and keep you updated.

You also have the right to complain to the Information Commissioner's Office:

Website: ico.org.uk/make-a-complaint
Phone: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Complaints about our mortgage or insurance advice (rather than your data) follow our separate complaints procedure and may be referred to the Financial Ombudsman Service.

Changes. We review this notice regularly and will update it if the way we handle your information changes. The date at the top shows when it was last updated.