Legal

Privacy policy

Last updated: [insert date] · This is a draft prepared for legal review and is not yet in force.

Mortgage Ready ("we", "us", "our") is the trading name of [Company Legal Name] Ltd, a company registered in England & Wales (company number [insert]), with registered office at [insert address]. We are the data controller for personal data collected through our marketing website at mortgage-ready.uk and related pages.

This notice explains how we collect and use personal data when you use our marketing website, get in touch, or sign up for the Mortgage Ready service. A separate customer-facing Data Processing Agreement governs our handling of the personal data your firm processes inside the Mortgage Ready service, where we act as a data processor.

1. Personal data we collect

• Enquiry data — your name, work email, firm name, phone, role, and anything you write in our contact form.
• Account data — the details you provide when creating a Mortgage Ready workspace (email, name, firm, chosen subdomain, password).
• Billing data — name, billing address, VAT number, card details (card details are processed directly by our payment provider and we do not store them).
• Usage & technical data — IP address, browser type, device type, pages visited, referrer, timestamps, and similar information collected via cookies and server logs.
• Support & correspondence — records of messages you send us.

2. How we use your data & our lawful basis

• To respond to enquiries and demo requests — legitimate interests (responding to requests you've made to us).
• To provide the Mortgage Ready service — performance of our contract with you.
• To invoice and take payment — performance of our contract and our legal obligations (tax/accounting).
• To keep the service secure and prevent abuse — legitimate interests (security and integrity).
• To improve our website and product — consent (where analytics cookies are used) or legitimate interests (server logs).
• To send service communications (billing, security, important updates) — performance of contract.
• To send marketing communications to existing customers about similar products — soft opt-in under PECR, with an easy opt-out in every message.
• To comply with legal obligations — where required by applicable law.

3. Cookies & similar technologies

We use essential cookies that make the site work. With your consent we also use analytics cookies to help us understand how the site is used. We do not use advertising cookies. You can accept or reject non-essential cookies from the cookie banner, and change your mind any time via our cookie policy.

4. Who we share data with

We share personal data with a small number of trusted service providers who help us operate the service. Current sub-processors include:

• Cloud hosting — [e.g. AWS / GCP / Hetzner], UK/EU region.
• Email delivery — [e.g. Postmark / SendGrid] for transactional email.
• Payment processing — [e.g. Stripe] for card payments and billing.
• Analytics — [e.g. Plausible / Fathom / GA4] for privacy-friendly website analytics (only with consent).
• Customer support tools — [insert provider].

A current list of sub-processors is available on request. We do not sell your personal data.

5. International transfers

Customer data is stored in UK and/or EU data centres. Where we use service providers outside the UK/EU, we rely on appropriate safeguards such as the UK International Data Transfer Agreement (IDTA), UK Addendum to the EU Standard Contractual Clauses, or UK adequacy regulations.

6. Data retention

• Enquiry data — retained for up to 24 months from last contact, then deleted.
• Account data — retained while your account is active and for up to 30 days after cancellation, after which it is deleted unless we have a legal obligation to retain it.
• Invoicing / tax records — retained for 7 years (UK tax law).
• Server logs — retained for 90 days.

7. Your rights

Under the UK GDPR you have rights to: access your data; correct it; erase it; restrict or object to processing; port it to another provider; and withdraw consent at any time. To exercise any of these rights, email privacy@mortgage-ready.uk.

You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. We'd prefer the chance to put things right first, so please do get in touch before you do.

8. Security

We use industry-standard security measures including encryption in transit (TLS) and at rest, role-based access controls, auditable logs, and regular backups. No system is perfectly secure, but we work hard to keep yours as safe as it reasonably can be.

9. Children

Mortgage Ready is a B2B service and is not directed at children. We do not knowingly collect personal data from anyone under 18.

10. Changes to this notice

We'll update this notice from time to time. When we make material changes we'll let you know via email or a prominent notice in the service.

11. Contact us

Privacy questions, requests or complaints: privacy@mortgage-ready.uk.
Postal address: [insert registered office].